python38:3.8 security update

Python is an interpreted, interactive, object-oriented programming language,
which includes modules, classes, exceptions, very high level dynamic data types
and dynamic typing. Python supports interfaces to many system calls and
libraries, as well as to various windowing systems.

Security Fix(es):

* python: CRLF injection via HTTP request method in httplib/http.client
(CVE-2020-26116)
* python-lxml: mXSS due to the use of improper parser (CVE-2020-27783)
* python: Stack-based buffer overflow in PyCArg_repr in _ctypes/callproc.c
(CVE-2021-3177)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s)
listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Asianux Server 8.4
Release Notes linked from the References section.

CVE-2020-26116
http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before
3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the
HTTP request method, as demonstrated by inserting CR and LF control characters
in the first argument of HTTPConnection.request.
CVE-2020-27783
A XSS vulnerability was discovered in python-lxml's clean module. The module's
parser didn't properly imitate browsers, which caused different behaviors
between the sanitizer and the user's page. A remote attacker could exploit this
flaw to run arbitrary HTML/JS code.
CVE-2021-3177
Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in
_ctypes/callproc.c, which may lead to remote code execution in certain Python
applications that accept floating-point numbers as untrusted input, as
demonstrated by a 1e300 argument to c_double.from_param. This occurs because
sprintf is used unsafely.

Modularity name: python38
Stream name: 3.8