Groups > comp.lang.python.announce > #3128

[SECURITY] Twisted 19.2.1 Release Announcement

Path	csiph.com!newsfeed.xs4all.nl!newsfeed8.news.xs4all.nl!fu-berlin.de!uni-berlin.de!not-for-mail
From	Amber Brown <hawkowl@atleastfornow.net>
Newsgroups	comp.lang.python.announce
Subject	[SECURITY] Twisted 19.2.1 Release Announcement
Date	Fri, 7 Jun 2019 00:46:36 +1000
Lines	29
Approved	python-announce-list@python.org
Message-ID	<mailman.5.1559832653.21674.python-announce-list@python.org> (permalink)
References	<c3bbe552-74bb-bb10-867c-da816f9fa8da@atleastfornow.net>
Mime-Version	1.0
Content-Type	text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding	7bit
X-Trace	news.uni-berlin.de MW7aW9/XpSXFJGwxanXXdQXdNYZ37cHL91etpHR6+TPw==
Return-Path	<hawkowl@atleastfornow.net>
X-Original-To	python-announce-list@python.org
Delivered-To	python-announce-list@mail.python.org
X-Spam-Status	OK 0.000
X-Spam-Evidence	'H': 1.00; 'S': 0.00; 'url:github': 0.03; 'url- ip:140.82.118/24': 0.04; 'url-ip:140.82/16': 0.04; 'alex': 0.07; 'urllib2': 0.07; 'received:192.168.1.2': 0.09; 'release,': 0.09; 'url:pypi': 0.09; '(or': 0.10; 'python': 0.13; '<>.': 0.16; 'characters.': 0.16; 'subject:Announcement': 0.16; 'subject:Release': 0.16; 'twisted': 0.16; 'url:rst': 0.16; 'valueerror': 0.16; 'bug': 0.16; 'url-ip:140/8': 0.18; 'url:wiki': 0.18; 'raise': 0.21; 'subject:] ': 0.21; 'url:bugs': 0.21; 'url- ip:151.101.0.223/32': 0.23; 'url-ip:151.101.128.223/32': 0.23; 'url-ip:151.101.192.223/32': 0.23; 'url-ip:151.101.64.223/32': 0.23; 'url-ip:188.166/16': 0.24; 'url-ip:188.166.48.69/32': 0.24; 'url-ip:188.166.48/24': 0.24; 'url-ip:151.101.192/24': 0.26; 'to:21': 0.26; 'url-ip:151.101.0/24': 0.26; 'url- ip:151.101.128/24': 0.26; 'url-ip:151.101.64/24': 0.26; 'header :User-Agent:1': 0.27; 'url-ip:188/8': 0.29; 'to:addr:python- announce-list': 0.29; 'versions': 0.30; 'url-ip:151.101/16': 0.31; 'url-ip:151/8': 0.31; 'received:192.168.1': 0.31; '<>.': 0.32; 'subject:[': 0.33; 'announce': 0.33; 'file': 0.35; 'received:google.com': 0.35; 'received:192.168': 0.35; 'recommended': 0.36; 'to:no real name:21': 0.36; 'and/or': 0.37; 'url:downloads': 0.37; 'url': 0.38; 'received:192': 0.39; 'version': 0.39; 'update': 0.60; 'your': 0.63; 'available': 0.63; 'information': 0.63; 'soon': 0.64; 'url-ip:66/8': 0.64; 'clients': 0.72; 'amber': 0.84; 'honoured': 0.84
DKIM-Signature	v=1; a=rsa-sha256; c=relaxed/relaxed; d=atleastfornow-net.20150623.gappssmtp.com; s=20150623; h=to:from:subject:message-id:date:user-agent:mime-version :content-language; bh=ekYUiU9OGQbq8WBcU2jJN8HyJ4ER3WWaPRnMVq3h8aA=; b=skosCm8RIZUSx6s0WyPmLMn1LhxLhyrahTWUefvksHsadrvyFZxR7eqnmE+swtvR9B fVdHZQpdo0GDTovMoB+0OR3y5ERvs2kJ5GULvl0KVrPbsvRzDNalPaF9vjCWvLsbHM/V SCfP9lp7fo981k7WnJ799mH2Puakki9TLDqUFINUGuniW6WE6cbvoqd6nA9eRfepEZt5 ze86bEaBoua94nVaTVDp20ugrqxptyo8NcoZ+6csC95mY4+9C+YQ5jrACgn/6zLCPJv1 HQIF2EEHFk9APs5Eu7fVR9PVRnqnhZVj7JO+8+AbfdD2AK1W4AWHNALj1XW9U5NzWK1/ 6rfg==
X-Google-DKIM-Signature	v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:to:from:subject:message-id:date:user-agent :mime-version:content-language; bh=ekYUiU9OGQbq8WBcU2jJN8HyJ4ER3WWaPRnMVq3h8aA=; b=juQuEmNxOS8G1SR+L+2xPCIQx6A8OGpJ9qu6LRuskcHYd56+iVqbM61BZpG9BSujAH XHczxXQtp3t9TCVnHELzgaumMlXnS6t4fsB3KMfxfsIK00ZOekIMQtosNZ2t7zH3M9lK Qr93IwPT3WUq0vj6VkG2thC+gZkcQxXCrU7N2qfLTvlBtLXHNbHNy9sUPuXUy1LHtlfc lxVGFmGX75LnhORS/5fEw/drmGfdip87L+ZZX9j7/rII4zk5MezxpQsKa00axmC222qm +BdyT5ib521f+ANWBkBSwQJRC1/e4g85LuctKqpCe8QF6WgXq6d55cn5lOoltRpMb7Nr XZFQ==
X-Gm-Message-State	APjAAAV1fZnRT8Ru4wJmo0LM1UyCOeCzEthyoPYNnYq3ZmYThsbAfBKs zkmhpFU/BpSJlDwxoXnFCDNkECMepCI=
X-Google-Smtp-Source	APXvYqwo5hfBIVuKPwTsO9nvjZg4iLl5tir4ABUm1RHhYLafnQqflNQWyJ3BbECszEdFQ1qbmpJFDQ==
X-Received	by 2002:a17:90a:1785:: with SMTP id q5mr261402pja.106.1559832402760; Thu, 06 Jun 2019 07:46:42 -0700 (PDT)
User-Agent	Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.7.0
Content-Language	en-US
X-Mailman-Approved-At	Thu, 06 Jun 2019 10:50:52 -0400
X-Content-Filtered-By	Mailman/MimeDel 2.1.29
X-BeenThere	python-announce-list@python.org
X-Mailman-Version	2.1.29
Precedence	list
List-Id	Announcement-only list for the Python programming language <python-announce-list.python.org>
List-Unsubscribe	<https://mail.python.org/mailman/options/python-announce-list>, <mailto:python-announce-list-request@python.org?subject=unsubscribe>
List-Archive	<http://mail.python.org/pipermail/python-announce-list/>
List-Post	<mailto:python-announce-list@python.org>
List-Help	<mailto:python-announce-list-request@python.org?subject=help>
List-Subscribe	<https://mail.python.org/mailman/listinfo/python-announce-list>, <mailto:python-announce-list-request@python.org?subject=subscribe>
X-Mailman-Original-Message-ID	<c3bbe552-74bb-bb10-867c-da816f9fa8da@atleastfornow.net>
Xref	csiph.com comp.lang.python.announce:3128

Show key headers only | View raw

On behalf of Twisted Matrix Laboratories, I am honoured to announce the 
release of Twisted 19.2.1!

This is a security release, and contains the following changes:

- All HTTP clients in twisted.web.client now raise a ValueError when 
called with a method and/or URL that contain invalid characters. This 
mitigates CVE-2019-12387. Thanks to Alex Brasetvik for reporting this 
vulnerability.

It is recommended you update to this release as soon as is practical.

Additional mitigation may be required if Twisted is not your only HTTP 
client library:

- This bug is present in all current versions of urllib2 in CPython. 
More information can be found on the Python bug tracker: 
https://bugs.python.org/issue30458
- This bug was present in urllib3 up until version 1.24.3. More 
information can be found on the urllib3 bug tracker: 
https://github.com/urllib3/urllib3/issues/1553

You can find the downloads at <https://pypi.python.org/pypi/Twisted> (or 
alternatively <http://twistedmatrix.com/trac/wiki/Downloads>). The NEWS 
file is also available at 
<https://github.com/twisted/twisted/blob/twisted-19.2.1/NEWS.rst>.

Twisted Regards,
Amber Brown (HawkOwl)

Back to comp.lang.python.announce | Previous | Next | Find similar | Unroll thread

Thread

[SECURITY] Twisted 19.2.1 Release Announcement Amber Brown <hawkowl@atleastfornow.net> - 2019-06-07 00:46 +1000

csiph-web