June 2021 security backports ;-)
Ok, here's another batch of potentially interesting commits I've found and rebased for PyPy3:
This is non-controversial upstream secfix, applied cleanly to the pypy3.7 branch.
That said, the included test is meaningless.
Upstream doesn't consider this a security fix but I think this could be easily used for DoS if someone used
shutil.unpack_archive()to unpack user-uploaded files. The patch seems simple enough, so I've backported it to all CPython versions in Gentoo.
This one is somewhat controversial. Originally it was devised against 3.8 where upstream first started permitting all kinds of leading zeros, then reverted that and instead started rejecting them all. 3.7 is somewhere in between rejecting numbers that are ambiguous between decimal and octal. I've decided to backport this to CPython < 3.8 in Gentoo to have more consistent (and safer) behavior of rejecting all IP addresses with leading zeros.
The following change could also be of interest but I didn't backport it due to completely different SSL module in PyPy:
I suppose you might want to look into hardening the SSL defaults in PyPy too.
1+4 also apply to PyPy2.7 but I've decided that backporting 1 was too much effort.