| .. bpo: 29591 |
| .. date: 2017-07-11-22-26-48 |
| .. nonce: cOeMX- |
| .. release date: 2017-07-23 |
| .. section: Security |
| |
| Update expat copy from 2.1.1 to 2.2.0 to get fixes of CVE-2016-0718 and |
| CVE-2016-4472. See https://sourceforge.net/p/expat/bugs/537/ for more |
| information. |
| |
| .. |
| |
| .. bpo: 30694 |
| .. date: 2017-07-11-22-25-24 |
| .. nonce: oOf3Er |
| .. section: Security |
| |
| Upgrade expat copy from 2.2.0 to 2.2.1 to get fixes of multiple security |
| vulnerabilities including: CVE-2017-9233 (External entity infinite loop |
| DoS), CVE-2016-9063 (Integer overflow, re-fix), CVE-2016-0718 (Fix |
| regression bugs from 2.2.0's fix to CVE-2016-0718) and CVE-2012-0876 |
| (Counter hash flooding with SipHash). Note: the CVE-2016-5300 (Use os- |
| specific entropy sources like getrandom) doesn't impact Python, since Python |
| already gets entropy from the OS to set the expat secret using |
| ``XML_SetHashSalt()``. |
| |
| .. |
| |
| .. bpo: 26657 |
| .. date: 2017-07-11-22-07-03 |
| .. nonce: wvpzFD |
| .. section: Security |
| |
| Fix directory traversal vulnerability with http.server on Windows. This |
| fixes a regression that was introduced in 3.3.4rc1 and 3.4.0rc1. Based on |
| patch by Philipp Hagemeister. |
| |
| .. |
| |
| .. bpo: 30500 |
| .. date: 2017-07-11-22-02-51 |
| .. nonce: wXUrkQ |
| .. section: Security |
| |
| Fix urllib.parse.splithost() to correctly parse fragments. For example, |
| ``splithost('//127.0.0.1#@evil.com/')`` now correctly returns the |
| ``127.0.0.1`` host, instead of treating ``@evil.com`` as the host in an |
| authentification (``login@host``). |
| |
| .. |
| |
| .. bpo: 30730 |
| .. date: 02 |
| .. nonce: ZF8XGV |
| .. original section: Library |
| .. section: Security |
| |
| Prevent environment variables injection in subprocess on Windows. Prevent |
| passing other invalid environment variables and command arguments. |
| |
| .. |
| |
| .. bpo: 26617 |
| .. date: 2017-07-15-13-55-22 |
| .. nonce: Gh5LvN |
| .. section: Core and Builtins |
| |
| Fix crash when GC runs during weakref callbacks. |
| |
| .. |
| |
| .. bpo: 27945 |
| .. date: 04 |
| .. nonce: p29r3O |
| .. section: Core and Builtins |
| |
| Fixed various segfaults with dict when input collections are mutated during |
| searching, inserting or comparing. Based on patches by Duane Griffin and |
| Tim Mitchell. |
| |
| .. |
| |
| .. bpo: 27850 |
| .. date: 01 |
| .. nonce: kIVQ0m |
| .. section: Library |
| |
| Remove 3DES from ssl module's default cipher list to counter measure sweet32 |
| attack (CVE-2016-2183). |
| |
| .. |
| |
| .. bpo: 25008 |
| .. date: 03 |
| .. nonce: CeIzyU |
| .. section: Documentation |
| |
| Document smtpd.py as effectively deprecated and add a pointer to aiosmtpd, a |
| third-party asyncio-based replacement. |
