python38:3.8 and python38-devel:3.8 security update

Python is an interpreted, interactive, object-oriented programming language,
which includes modules, classes, exceptions, very high level dynamic data types
and dynamic typing. Python supports interfaces to many system calls and
libraries, as well as to various windowing systems.

The following packages have been upgraded to a later upstream version: python38
(3.8), python38-devel (3.8).

Security Fix(es):

* python: urllib: Regular expression DoS in AbstractBasicAuthHandler
(CVE-2021-3733)
* python-lxml: HTML Cleaner allows crafted and SVG embedded scripts to pass
through (CVE-2021-43818)
* python: urllib.parse does not sanitize URLs containing ASCII newline and
tabs (CVE-2022-0391)
* python: urllib: HTTP client possible infinite loop on a 100 Continue
response (CVE-2021-3737)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s)
listed in the References section.

Additional Changes:

CVE-2021-3733
There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who
controls a malicious HTTP server that an HTTP client (such as web browser)
connects to, could trigger a Regular Expression Denial of Service (ReDOS) during
an authentication request with a specially crafted payload that is sent by the
server to the client. The greatest threat that this flaw poses is to application
availability.
CVE-2021-3737
A flaw was found in python. An improperly handled HTTP response in the HTTP
client code of python may allow a remote attacker, who controls the HTTP server,
to make the client script enter an infinite loop, consuming CPU time. The
highest threat from this vulnerability is to system availability.
CVE-2021-43818
lxml is a library for processing XML and HTML in the Python language. Prior to
version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted script content
pass through, as well as script content in SVG files embedded using data URIs.
Users that employ the HTML cleaner in a security relevant context should upgrade
to lxml 4.6.5 to receive a patch. There are no known workarounds available.
CVE-2022-0391
A flaw was found in Python, specifically within the urllib.parse module. This
module helps break Uniform Resource Locator (URL) strings into components. The
issue involves how the urlparse method does not sanitize input and allows
characters like '\r' and '\n' in the URL path. This flaw allows an attacker to
input a crafted URL, leading to injection attacks. This flaw affects Python
versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14.

Modularity name: python38
Stream name: 3.8