This issue tracker has been migrated to GitHub, and is currently read-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

classification
Title: Windows installer ships an outdated and insecure curl.exe
Type: Stage: resolved
Components: Windows Versions: Python 3.5
process
Status: closed Resolution: not a bug
Dependencies: Superseder:
Assigned To: Nosy List: donmez, paul.moore, steve.dower, tim.golden, zach.ware
Priority: normal Keywords:

Created on 2015-12-23 15:38 by donmez, last changed 2022-04-11 14:58 by admin. This issue is now closed.

Messages (3)
msg256918 - (view) Author: Ismail Donmez (donmez) * Date: 2015-12-23 15:38
Installed Python 3.5.1 windows x64 version and ended up having

C:\Users\ismail\AppData\Local\Programs\Python\Python35\curl.exe

which is outdated:

C:\Users\ismail>C:\Users\ismail\AppData\Local\Programs\Python\Python35\curl.exe -V
curl 7.37.0 (Windows) libcurl/7.37.0 OpenSSL/1.0.2d zlib/1.2.8
Protocols: dict file ftp ftps gopher http https imap imaps pop3 pop3s rtsp smtp smtps telnet tftp
Features: NTLM SSL libz

That is released in May 2014!

Also its insecure:

C:\Users\ismail>C:\Users\ismail\AppData\Local\Programs\Python\Python35\curl.exe -vvvv "https://www.g
oogle.com"
* Rebuilt URL to: https://www.google.com/
* timeout on name lookup is not supported
* Hostname was NOT found in DNS cache
*   Trying 173.194.32.177...
* Connected to www.google.com (173.194.32.177) port 443 (#0)
* libcurl is now using a weak random seed!
[...]

I would be happy if you don't ship curl at all, or at least use a secure, up-to-date version from https://bintray.com/vszakats/generic/curl/view
msg256919 - (view) Author: Zachary Ware (zach.ware) * (Python committer) Date: 2015-12-23 15:45
I have no idea how you got a curl.exe there, but it didn't come from our installer.  Where did you get your 3.5.1 installer from?
msg256924 - (view) Author: Ismail Donmez (donmez) * Date: 2015-12-23 16:51
Indeed, I am sorry! It was pycurl.
History
Date User Action Args
2022-04-11 14:58:25adminsetgithub: 70120
2015-12-23 16:51:20donmezsetmessages: + msg256924
2015-12-23 15:45:57zach.waresetstatus: open -> closed
resolution: not a bug
messages: + msg256919

stage: resolved
2015-12-23 15:38:03donmezcreate