python39:3.9 and python39-devel:3.9 security update

Python is an interpreted, interactive, object-oriented programming language,
which includes modules, classes, exceptions, very high level dynamic data types
and dynamic typing. Python supports interfaces to many system calls and
libraries, as well as to various windowing systems.

The following packages have been upgraded to a later upstream version: python39
(3.9.16).

Security Fix(es):

* python: int() type in PyLong_FromString() does not limit amount of digits
converting text to int leading to DoS (CVE-2020-10735)
* python: open redirection vulnerability in lib/http/server.py may lead to
information disclosure (CVE-2021-28861)
* python: CPU denial of service via inefficient IDNA decoder (CVE-2022-45061)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s)
listed in the References section.

CVE-2020-10735
A flaw was found in python. In algorithms with quadratic time complexity using
non-binary bases, when using int("text"), a system could take 50ms to parse an
int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal,
int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not
affected). The highest threat from this vulnerability is to system availability.
CVE-2021-28861
** DISPUTED ** Python 3.x through 3.10 has an open redirection vulnerability in
lib/http/server.py due to no protection against multiple (/) at the beginning of
URI path which may leads to information disclosure. NOTE: this is disputed by a
third party because the http.server.html documentation page states "Warning:
http.server is not recommended for production. It only implements basic security
checks."
CVE-2022-45061
An issue was discovered in Python before 3.11.1. An unnecessary quadratic
algorithm exists in one path when processing some inputs to the IDNA (RFC 3490)
decoder, such that a crafted, unreasonably long name being presented to the
decoder could lead to a CPU denial of service. Hostnames are often supplied by
remote servers that could be controlled by a malicious actor; in such a
scenario, they could trigger excessive CPU consumption on the client attempting
to make use of an attacker-supplied supposed hostname. For example, the attack
payload could be placed in the Location header of an HTTP response with status
code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16.

Modularity name: python39
Stream name: 3.9