|
| 1 | +.. bpo: 44022 |
| 2 | +.. date: 2021-05-05-17-37-04 |
| 3 | +.. nonce: bS3XJ9 |
| 4 | +.. release date: 2021-06-28 |
| 5 | +.. section: Security |
| 6 | +
|
| 7 | +mod:`http.client` now avoids infinitely reading potential HTTP headers after |
| 8 | +a ``100 Continue`` status response from the server. |
| 9 | + |
| 10 | +.. |
| 11 | +
|
| 12 | +.. bpo: 43882 |
| 13 | +.. date: 2021-04-25-07-46-37 |
| 14 | +.. nonce: Jpwx85 |
| 15 | +.. section: Security |
| 16 | +
|
| 17 | +The presence of newline or tab characters in parts of a URL could allow some |
| 18 | +forms of attacks. |
| 19 | + |
| 20 | +Following the controlling specification for URLs defined by WHATWG |
| 21 | +:func:`urllib.parse` now removes ASCII newlines and tabs from URLs, |
| 22 | +preventing such attacks. |
| 23 | + |
| 24 | +.. |
| 25 | +
|
| 26 | +.. bpo: 42988 |
| 27 | +.. date: 2021-03-24-14-16-56 |
| 28 | +.. nonce: P2aNco |
| 29 | +.. section: Security |
| 30 | +
|
| 31 | +CVE-2021-3426: Remove the ``getfile`` feature of the :mod:`pydoc` module |
| 32 | +which could be abused to read arbitrary files on the disk (directory |
| 33 | +traversal vulnerability). Moreover, even source code of Python modules can |
| 34 | +contain sensitive data like passwords. Vulnerability reported by David |
| 35 | +Schwörer. |
| 36 | + |
| 37 | +.. |
| 38 | +
|
| 39 | +.. bpo: 43285 |
| 40 | +.. date: 2021-03-13-03-48-14 |
| 41 | +.. nonce: g-Hah3 |
| 42 | +.. section: Security |
| 43 | +
|
| 44 | +:mod:`ftplib` no longer trusts the IP address value returned from the server |
| 45 | +in response to the PASV command by default. This prevents a malicious FTP |
| 46 | +server from using the response to probe IPv4 address and port combinations |
| 47 | +on the client network. |
| 48 | + |
| 49 | +Code that requires the former vulnerable behavior may set a |
| 50 | +``trust_server_pasv_ipv4_address`` attribute on their :class:`ftplib.FTP` |
| 51 | +instances to ``True`` to re-enable it. |
| 52 | + |
| 53 | +.. |
| 54 | +
|
| 55 | +.. bpo: 43075 |
| 56 | +.. date: 2021-01-31-05-28-14 |
| 57 | +.. nonce: DoAXqO |
| 58 | +.. section: Security |
| 59 | +
|
| 60 | +Fix Regular Expression Denial of Service (ReDoS) vulnerability in |
| 61 | +:class:`urllib.request.AbstractBasicAuthHandler`. The ReDoS-vulnerable |
| 62 | +regex has quadratic worst-case complexity and it allows cause a denial of |
| 63 | +service when identifying crafted invalid RFCs. This ReDoS issue is on the |
| 64 | +client side and needs remote attackers to control the HTTP server. |
| 65 | + |
| 66 | +.. |
| 67 | +
|
| 68 | +.. bpo: 43660 |
| 69 | +.. date: 2021-03-29-19-50-34 |
| 70 | +.. nonce: scTgag |
| 71 | +.. section: Core and Builtins |
| 72 | +
|
| 73 | +Fix crash that happens when replacing ``sys.stderr`` with a callable that |
| 74 | +can remove the object while an exception is being printed. Patch by Pablo |
| 75 | +Galindo. |
| 76 | + |
| 77 | +.. |
| 78 | +
|
| 79 | +.. bpo: 41561 |
| 80 | +.. date: 2021-03-18-10-34-42 |
| 81 | +.. nonce: pDg4w- |
| 82 | +.. section: Tests |
| 83 | +
|
| 84 | +Add workaround for Ubuntu's custom OpenSSL security level policy. |
0 commit comments