Notice: While JavaScript is not essential for this website, your interaction with the content will be limited. Please turn JavaScript on for the full experience.

Python 3.8.14

Release Date: Sept. 6, 2022

This is a security release of Python 3.8

Note: The release you're looking at is Python 3.8.13, a security bugfix release for the legacy 3.8 series. Python 3.10 is now the latest feature release series of Python 3. Get the latest release of 3.10.x here.

Security content in this release

  • CVE-2020-10735: converting between int and str in bases other than 2 (binary), 4, 8 (octal), 16 (hexadecimal), or 32 such as base 10 (decimal) now raises a ValueError if the number of digits in string form is above a limit to avoid potential denial of service attacks due to the algorithmic complexity.
  • gh-87389: http.server: Fix an open redirection vulnerability in the HTTP server when an URI path starts with //.
  • gh-93065: Fix contextvars HAMT implementation to handle iteration over deep trees to avoid a potential crash of the interpreter.
  • gh-90355: Fix ensurepip environment isolation for the subprocess running pip.
  • gh-80254: Raise ProgrammingError instead of segfaulting on recursive usage of cursors in sqlite3 converters.

No installers

According to the release calendar specified in PEP 569, Python 3.8 is now in the "security fixes only" stage of its life cycle: 3.8 branch only accepts security fixes and releases of those are made irregularly in source-only form until October 2024. Python 3.8 isn't receiving regular bug fixes anymore, and binary installers are no longer provided for it. Python 3.8.10 was the last full bugfix release of Python 3.8 with binary installers.

Full Changelog

Files

Version Operating System Description MD5 Sum File Size GPG Sigstore
Gzipped source tarball Source release a82168eb586e19122b747b84038825f2 25306520 SIG CRT SIG
XZ compressed source tarball Source release 78710eed185b71f4198d354502ff62c9 19031932 SIG CRT SIG