[osgeo4w-dev] [osgeo4w] #859: QGIS LTR Python version update to v3.12.8

[OSGeo4W]

#859: QGIS LTR Python version update to v3.12.8
-----------------------------+----------------------------
Reporter:  ascottwwf         |       Owner:  osgeo4w-dev@…
    Type:  defect            |      Status:  new
Priority:  normal            |   Component:  Package
 Version:                    |  Resolution:
Keywords:  Python, QGIS LTR  |
-----------------------------+----------------------------
Description changed by ascottwwf:

Old description:

> Hello,
>
> I have noticed that Python released new versions on 3rd December to fix a
> number of issues.
> It may subsequently come to light that these updates include security
> fixes for published CVEs, so is usually beneficial to update before the
> CVE's are publicised.
> If it has not already been done, Would it be possible to please update
> the Python version included with QGIS LTR to 3.12.8?
>
> Thanks in advance

New description:

 Hello,

 I have noticed that Python released new versions on 3rd December to fix a
 number of issues.
 It may subsequently come to light that these updates include security
 fixes for published CVEs, so is usually beneficial to update before the
 CVE's are publicised.


 As it subsequently turns out, Python 3.12.7 is vulnerable to the following
 3 CVEs:
 - CVE-2024-9287 (Medium Severity)
 - CVE-2024-50602 (Medium Severity)
 - CVE-2024-12254 (High Severity)
 Therefore, as QGIS LTR 3.34.13 contains Python 3.12.7, if it has not
 already been done, Would it be possible to please update the Python
 version included with QGIS LTR to 3.12.8 to fix the above CVEs?

 Thanks in advance

--
-- 
Ticket URL: <https://trac.osgeo.org/osgeo4w/ticket/859#comment:1>
OSGeo4W <http://trac.osgeo.org/osgeo4w>
OSGeo4W is the Windows installer and package environment for the OSGeo stack.