Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package python-markdown2 for openSUSE:Factory checked in at 2026-11-04 19:45:34 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/python-markdown2 (Old) and /work/SRC/openSUSE:Factory/.python-markdown2.new.3759290 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "python-markdown2" Wed Nov 4 19:45:34 2026 rev:21 rq:1394815 version:2.5.5 Changes: -------- --- /work/SRC/openSUSE:Factory/python-markdown2/python-markdown2.changes 2026-10-16 20:13:44.888403974 +0200 +++ /work/SRC/openSUSE:Factory/.python-markdown2.new.3759290/python-markdown2.changes 2026-11-04 19:49:09.548693865 +0100 @@ -1,0 +2,7 @@ +Wed Nov 4 01:29:42 UTC 2026 - Steve Kowalik <[email protected]> + +- CVE-2026-118694: Fix quadratic time for unclosed inline-link parentheses + (bsc#1288876) + * Add patch CVE-2026-118694-unclosed-inline-link-parentheses.patch + +------------------------------------------------------------------- New: ---- CVE-2026-118694-unclosed-inline-link-parentheses.patch ----------(New B)---------- New: (bsc#1288876) * Add patch CVE-2026-118694-unclosed-inline-link-parentheses.patch ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ python-markdown2.spec ++++++ --- /var/tmp/diff_new_pack.B61nYS/_old 2026-11-04 19:49:10.320726206 +0100 +++ /var/tmp/diff_new_pack.B61nYS/_new 2026-11-04 19:49:10.325726415 +0100 @@ -22,10 +22,11 @@ Release: 0 Summary: A Python implementation of Markdown License: MIT -Group: Development/Languages/Python URL: https://github.com/trentm/python-markdown2 Source: https://files.pythonhosted.org/packages/source/m/markdown2/markdown2-%{version}.tar.gz Patch1: 0001-Avoid-overlapping-regex-matches-that-trigger-excessi.patch +# PATCH-FIX-UPSTREAM bsc#1288876 Based on gh#trentm/python-markdown2#751 +Patch2: CVE-2026-118694-unclosed-inline-link-parentheses.patch BuildRequires: %{python_module pip} BuildRequires: %{python_module pygments} BuildRequires: %{python_module setuptools} ++++++ CVE-2026-118694-unclosed-inline-link-parentheses.patch ++++++ ++++ 899 lines (skipped)
