From d20970fdf39a1593dc290cd19d4f47f348fabdcb Mon Sep 17 00:00:00 2001 From: npt-1707 Date: Mon, 4 May 2026 01:53:57 +0800 Subject: [PATCH] layout/usr/lib/python3.7/ipaddress.py: Leading zeros in IPv4 addresses are no longer tolerated --- layout/usr/lib/python3.7/ipaddress.py | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/layout/usr/lib/python3.7/ipaddress.py b/layout/usr/lib/python3.7/ipaddress.py index cc9ae711..d48c1a13 100644 --- a/layout/usr/lib/python3.7/ipaddress.py +++ b/layout/usr/lib/python3.7/ipaddress.py @@ -1164,6 +1164,11 @@ def _parse_octet(cls, octet_str): if len(octet_str) > 3: msg = "At most 3 characters permitted in %r" raise ValueError(msg % octet_str) + # Handle leading zeros as strict as glibc's inet_pton() + # See security bug bpo-36384 + if octet_str != '0' and octet_str[0] == '0': + msg = "Leading zeros are not permitted in %r" + raise ValueError(msg % octet_str) # Convert to integer (we know digits are legal) octet_int = int(octet_str, 10) # Any octets that look like they *might* be written in octal,