4 ms·

Surely delaying an RCE fix for two weeks on supported versions of Python is a mistake.

• hexa- 6y ago
  Distros are backporting security patches into their releases, so no harm done. If you rely on the python.org releases and don't build from source, then yes, that is a bit sad. Case in point: The Debian security tracker, see their notes section referencing each commit. https://security-tracker.debian.org/tracker/CVE-2021-3177 https://security-tracker.debian.org/tracker/CVE-2021-3177
  • AaronFriel 6y ago
    The python:3.8 and python:3.9 container images if used to build web services such as Django with GIS extensions may have an RCE until Python.org sources are updated.
    • hexa- 6y ago
      Why can't the base image receive those patches as well?
      • AaronFriel 6y ago
        Those images pull from python.org sources, see: https://github.com/docker-library/python/blob/master/3.8/buster/Dockerfile https://github.com/docker-library/python/blob/master/3.8/bus...
• di 6y ago
  The release candidates are already available to use if you don't want to wait 2 weeks.