Date: Wed, 30 Oct 2019 12:10:20 +0100 From: Peter van Dijk <peter.van.dijk@...erdns.com> To: oss-security@...ts.openwall.com Subject: Python-3.5.8.tar.xz does NOT contain the fix for bpo-38243 Hello, Python 3.5.8 is supposed to contain a fix for bpo-38243, as mentioned at https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-8-final It turns out python.org has accidentally shipped 3.5.8 without that fix, if you pick tar.xz instead of .tgz. Please find attached the email I have sent them. I'm reporting this to oss-security so that no downstream distributors accidentally ship the wrong 3.5.8. I have also reported it directly to FreeBSD at https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=241586 as they are the only distribution I could think of that still actually ship vanilla Python 3.5. Kind regards, -- Peter van Dijk PowerDNS.COM BV - https://www.powerdns.com/ Content of type "message/rfc822" skipped Download attachment "signature.asc" of type "application/pgp-signature" (915 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.