Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 15 Jun 2016 10:42:48 +0200
From: Cedric Buissart <cbuissar@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request: Python HTTP header injection in urrlib2/urllib/httplib/http.client

Hi Tim,

On Tue, Jun 14, 2016 at 11:16 PM, Tim <tim-security@...tinelchicken.org>
wrote:

>
> In the mean time, do you happen to have specific information on which
> versions of the 2.x and 3.x upstream branches were affected/fixed?
>

Reproducible on all python versions I tested : 2.4, 2.6, 2.7, 3.4 and 3.5

Fixed branches :
3.4 / 3.5 : revision 94952 : https://hg.python.org/cpython/rev/bf3e1c9b80e9
2.7 : revision 94951 : https://hg.python.org/cpython/rev/1c45047c5102

Regards,

-- 
Cedric Buissart,
Product Security

Purkynova 99
Brno 612 45

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.