RetroSearch Browse

Tue Feb 25 08:53:49 CET 2014 · https://mail.python.org/pipermail/python-dev/2014-February/132760.html

On 25 February 2014 17:39, Christian Heimes <christian at python.org> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
>
> Hi,
>
> this looks pretty serious -- and it caught me off guard, too. :(
>
> https://www.trustedsec.com/february-2014/python-remote-code-execution-socket-recvfrom_into/
>
> Next time please inform the Python Security Response Team about any
> and all issues that are related to buffer overflows or similar bugs.
> In fact please drop a note about anything that even remotely look like
> an exploitable issue. Even public bug reports should be forwarded to PSRT.
>
> I have requested a CVE number. How about security releases? The
> upcoming 3.3 and 3.4 release should contain the fix (not verified
> yet).

I've checked these, and noted the relevant hg.python.org links on the
tracker issue at http://bugs.python.org/issue20246

> Python 2.7 to 3.2 will need a security release, though.

Agreed.

Cheers,
Nick.

-- 
Nick Coghlan   |   ncoghlan at gmail.com   |   Brisbane, Australia

Home - News ( United States | United Kingdom | Italy | Germany ) - Football scores

Showing content from https://mail.python.org/pipermail/python-dev/2014-February/132760.html below:

[Python-Dev] Python Remote Code Execution in socket.recvfrom_into()