6 ms·

Already fixed in Python 3.6, 3.7, 3.8 and 3.9: https://bugs.python.org/issue42938 https://bugs.python.org/issue42938 3.6.13 and 3.7.10 have already been releas

by di 6y ago

Already fixed in Python 3.6, 3.7, 3.8 and 3.9: https://bugs.python.org/issue42938 https://bugs.python.org/issue42938 3.6.13 and 3.7.10 have already been released with the fix: https://www.python.org/downloads/release/python-3613/ https://www.python.org/downloads/release/python-3613/ https://www.python.org/downloads/release/python-3710/ https://www.python.org/downloads/release/python-3710/ The 3.8.8 and 3.9.2 release candidates with the fix will be promoted on Monday March 1st: https://discuss.python.org/t/python-3-9-2rc1-and-3-8-8rc1-are-now-available-for-testing/7253 https://discuss.python.org/t/python-3-9-2rc1-and-3-8-8rc1-ar... If you're on 3.5 or lower, these versions are no longer receiving security fixes and will not be patched: https://python-release-cycle.glitch.me/ https://python-release-cycle.glitch.me/

AaronFriel 6y ago
Surely delaying an RCE fix for two weeks on supported versions of Python is a mistake.
- hexa- 6y ago
  Distros are backporting security patches into their releases, so no harm done. If you rely on the python.org releases and don't build from source, then yes, that is a bit sad. Case in point: The Debian security tracker, see their notes section referencing each commit. https://security-tracker.debian.org/tracker/CVE-2021-3177 https://security-tracker.debian.org/tracker/CVE-2021-3177
  - AaronFriel 6y ago
    The python:3.8 and python:3.9 container images if used to build web services such as Django with GIS extensions may have an RCE until Python.org sources are updated.
    - hexa- 6y ago
      Why can't the base image receive those patches as well?
      - AaronFriel 6y ago
        Those images pull from python.org sources, see: https://github.com/docker-library/python/blob/master/3.8/buster/Dockerfile https://github.com/docker-library/python/blob/master/3.8/bus...
- di 6y ago
  The release candidates are already available to use if you don't want to wait 2 weeks.
uranusjr 6y ago
Update: 3.8.8 and 3.9.2 have been released. https://discuss.python.org/t/python-3-9-2-and-3-8-8-are-now-available/7278 https://discuss.python.org/t/python-3-9-2-and-3-8-8-are-now-...

by di 6y ago

AaronFriel 6y ago

Surely delaying an RCE fix for two weeks on supported versions of Python is a mistake.

hexa- 6y ago
Distros are backporting security patches into their releases, so no harm done. If you rely on the python.org releases and don't build from source, then yes, that is a bit sad. Case in point: The Debian security tracker, see their notes section referencing each commit. https://security-tracker.debian.org/tracker/CVE-2021-3177 https://security-tracker.debian.org/tracker/CVE-2021-3177
- AaronFriel 6y ago
  The python:3.8 and python:3.9 container images if used to build web services such as Django with GIS extensions may have an RCE until Python.org sources are updated.
  - hexa- 6y ago
    Why can't the base image receive those patches as well?
    - AaronFriel 6y ago
      Those images pull from python.org sources, see: https://github.com/docker-library/python/blob/master/3.8/buster/Dockerfile https://github.com/docker-library/python/blob/master/3.8/bus...
di 6y ago
The release candidates are already available to use if you don't want to wait 2 weeks.

uranusjr 6y ago

Update: 3.8.8 and 3.9.2 have been released. https://discuss.python.org/t/python-3-9-2-and-3-8-8-are-now-available/7278 https://discuss.python.org/t/python-3-9-2-and-3-8-8-are-now-...