This issue tracker has been migrated to GitHub, and is currently read-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

classification
Title: Port fix of "issue44422" to Python3.6.x
Type: Stage: resolved
Components: Library (Lib) Versions: Python 3.6
process
Status: closed Resolution: out of date
Dependencies: Superseder:
Assigned To: Nosy List: arunman, ned.deily
Priority: normal Keywords:

Created on 2021-08-02 05:18 by arunman, last changed 2022-04-11 14:59 by admin. This issue is now closed.

Messages (2)
msg398725 - (view) Author: Arun (arunman) Date: 2021-08-02 05:18
We have seen multiple occurrences of the issue reported and fixed in https://bugs.python.org/issue44422, on RHEL8.3 with Python3.6.x. I understand RHEL8.4 is also shipping with Python3.6.x as the default version and it's going to be the same with RHEL8.5 as well. 

This bug is to port that fix to Python3.6.x version as well. This is impacting lot of our customers running large scale enterprise application.
msg398729 - (view) Author: Ned Deily (ned.deily) * (Python committer) Date: 2021-08-02 06:42
Sorry you are running into this problem. Alas, Python 3.6 has been in the "security-fix-only" phase of its life cycle for over 2.5 years now and will reach end-of-life in several months at the end of 2021. Our criteria for changes to a "security" branch are:
"The only changes made to a security branch are those fixing issues exploitable by attackers such as crashes, privilege escalation and, optionally, other issues such as denial of service attacks. Any other changes are not considered a security risk and thus not backported to a security branch."

The problem referenced here does not seem to meet those criteria and thus the original fix was not considered for backporting to current security branches, i.e. 3.8, 3.7, and 3.6. Unless it can be shown that the problem can be exploited as an attack vector, it is not eligible to be officially backported to 3.6.

However, there is nothing stopping either you or a downstream supplier of Python 3.6 (like RedHat) from backporting it yourselves.

https://devguide.python.org/devcycle/#security-branches
History
Date User Action Args
2022-04-11 14:59:48adminsetgithub: 88967
2021-08-02 06:42:14ned.deilysetstatus: open -> closed
resolution: out of date
messages: + msg398729

stage: resolved
2021-08-02 06:14:41serhiy.storchakasetnosy: + ned.deily
2021-08-02 05:18:58arunmancreate