➜
This issue tracker has been migrated to GitHub,
and is currently read-only.
For more information,
see the GitHub FAQs in the Python's Developer Guide.
Created on 2022-03-04 09:31 by zjmxq, last changed 2022-04-11 14:59 by admin. This issue is now closed.
| Messages (3) | |||
|---|---|---|---|
| msg414511 - (view) | Author: zjmxq (zjmxq) | Date: 2022-03-04 09:31 | |
Vulnerability CVE-2021-29921,CVE-2020-14422, CVE-2021-3572, CVE-2021-33503 Vulnerability Found in python 3.9.2 /lib/python3.9/ensurepip |
|||
| msg414513 - (view) | Author: Karthikeyan Singaravelan (xtreak) *  |
Date: 2022-03-04 10:04 | |
https://nvd.nist.gov/vuln/detail/CVE-2020-14422 Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an application is affected by the performance of a dictionary containing IPv4Interface or IPv6Interface objects, and this attacker can cause many dictionary entries to be created. This is fixed in: v3.5.10, v3.5.10rc1; v3.6.12; v3.7.9; v3.8.4, v3.8.4rc1, v3.8.5, v3.8.6, v3.8.6rc1; v3.9.0, v3.9.0b4, v3.9.0b5, v3.9.0rc1, v3.9.0rc2. This CVE is listed as fixed in 3.9.0RC2 though you have added 3.9.2 and also mentioned ensurepip which doesn't seem to be relevant. Can you please add more detail over how we can reproduce the vulnerability in latest master or latest stable 3.9 release and how this is related to ensurepip. |
|||
| msg414527 - (view) | Author: Ned Deily (ned.deily) * |
Date: 2022-03-04 14:14 | |
To emphasize, Python 3.9.2 is obsolete and no longer supported; at the moment, the current release of Python 3.9 is 3.9.10. The most current bugfix release (3.9.x) obsoletes all previous releases of that Python version (3.9); during a version's support lifecycle, we only provide fixes for the most recent bugfix release (3.9.10). (Downstream third-party distributors of Python may have different support policies.) https://www.python.org/downloads/ |
|||
| History | |||
|---|---|---|---|
| Date | User | Action | Args |
| 2022-04-11 14:59:56 | admin | set | github: 91074 |
| 2022-03-12 21:30:01 | ned.deily | set | status: open -> closed resolution: out of date stage: resolved |
| 2022-03-04 14:14:16 | ned.deily | set | nosy:
+ ned.deily messages: + msg414527 |
| 2022-03-04 10:04:52 | xtreak | set | nosy:
+ xtreak messages: + msg414513 |
| 2022-03-04 09:31:55 | zjmxq | create | |