Path: csiph.com!newsfeed.xs4all.nl!newsfeed8.news.xs4all.nl!fu-berlin.de!uni-berlin.de!not-for-mail From: Amber Brown Newsgroups: comp.lang.python.announce Subject: [SECURITY] Twisted 19.2.1 Release Announcement Date: Fri, 7 Jun 2019 00:46:36 +1000 Lines: 29 Approved: python-announce-list@python.org Message-ID: References: Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-Trace: news.uni-berlin.de MW7aW9/XpSXFJGwxanXXdQXdNYZ37cHL91etpHR6+TPw== Return-Path: X-Original-To: python-announce-list@python.org Delivered-To: python-announce-list@mail.python.org X-Spam-Status: OK 0.000 X-Spam-Evidence: '*H*': 1.00; '*S*': 0.00; 'url:github': 0.03; 'url- ip:140.82.118/24': 0.04; 'url-ip:140.82/16': 0.04; 'alex': 0.07; 'urllib2': 0.07; 'received:192.168.1.2': 0.09; 'release,': 0.09; 'url:pypi': 0.09; '(or': 0.10; 'python': 0.13; '<>.': 0.16; 'characters.': 0.16; 'subject:Announcement': 0.16; 'subject:Release': 0.16; 'twisted': 0.16; 'url:rst': 0.16; 'valueerror': 0.16; 'bug': 0.16; 'url-ip:140/8': 0.18; 'url:wiki': 0.18; 'raise': 0.21; 'subject:] ': 0.21; 'url:bugs': 0.21; 'url- ip:151.101.0.223/32': 0.23; 'url-ip:151.101.128.223/32': 0.23; 'url-ip:151.101.192.223/32': 0.23; 'url-ip:151.101.64.223/32': 0.23; 'url-ip:188.166/16': 0.24; 'url-ip:188.166.48.69/32': 0.24; 'url-ip:188.166.48/24': 0.24; 'url-ip:151.101.192/24': 0.26; 'to:2**1': 0.26; 'url-ip:151.101.0/24': 0.26; 'url- ip:151.101.128/24': 0.26; 'url-ip:151.101.64/24': 0.26; 'header :User-Agent:1': 0.27; 'url-ip:188/8': 0.29; 'to:addr:python- announce-list': 0.29; 'versions': 0.30; 'url-ip:151.101/16': 0.31; 'url-ip:151/8': 0.31; 'received:192.168.1': 0.31; '<>.': 0.32; 'subject:[': 0.33; 'announce': 0.33; 'file': 0.35; 'received:google.com': 0.35; 'received:192.168': 0.35; 'recommended': 0.36; 'to:no real name:2**1': 0.36; 'and/or': 0.37; 'url:downloads': 0.37; 'url': 0.38; 'received:192': 0.39; 'version': 0.39; 'update': 0.60; 'your': 0.63; 'available': 0.63; 'information': 0.63; 'soon': 0.64; 'url-ip:66/8': 0.64; 'clients': 0.72; 'amber': 0.84; 'honoured': 0.84 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=atleastfornow-net.20150623.gappssmtp.com; s=20150623; h=to:from:subject:message-id:date:user-agent:mime-version :content-language; bh=ekYUiU9OGQbq8WBcU2jJN8HyJ4ER3WWaPRnMVq3h8aA=; b=skosCm8RIZUSx6s0WyPmLMn1LhxLhyrahTWUefvksHsadrvyFZxR7eqnmE+swtvR9B fVdHZQpdo0GDTovMoB+0OR3y5ERvs2kJ5GULvl0KVrPbsvRzDNalPaF9vjCWvLsbHM/V SCfP9lp7fo981k7WnJ799mH2Puakki9TLDqUFINUGuniW6WE6cbvoqd6nA9eRfepEZt5 ze86bEaBoua94nVaTVDp20ugrqxptyo8NcoZ+6csC95mY4+9C+YQ5jrACgn/6zLCPJv1 HQIF2EEHFk9APs5Eu7fVR9PVRnqnhZVj7JO+8+AbfdD2AK1W4AWHNALj1XW9U5NzWK1/ 6rfg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:to:from:subject:message-id:date:user-agent :mime-version:content-language; bh=ekYUiU9OGQbq8WBcU2jJN8HyJ4ER3WWaPRnMVq3h8aA=; b=juQuEmNxOS8G1SR+L+2xPCIQx6A8OGpJ9qu6LRuskcHYd56+iVqbM61BZpG9BSujAH XHczxXQtp3t9TCVnHELzgaumMlXnS6t4fsB3KMfxfsIK00ZOekIMQtosNZ2t7zH3M9lK Qr93IwPT3WUq0vj6VkG2thC+gZkcQxXCrU7N2qfLTvlBtLXHNbHNy9sUPuXUy1LHtlfc lxVGFmGX75LnhORS/5fEw/drmGfdip87L+ZZX9j7/rII4zk5MezxpQsKa00axmC222qm +BdyT5ib521f+ANWBkBSwQJRC1/e4g85LuctKqpCe8QF6WgXq6d55cn5lOoltRpMb7Nr XZFQ== X-Gm-Message-State: APjAAAV1fZnRT8Ru4wJmo0LM1UyCOeCzEthyoPYNnYq3ZmYThsbAfBKs zkmhpFU/BpSJlDwxoXnFCDNkECMepCI= X-Google-Smtp-Source: APXvYqwo5hfBIVuKPwTsO9nvjZg4iLl5tir4ABUm1RHhYLafnQqflNQWyJ3BbECszEdFQ1qbmpJFDQ== X-Received: by 2002:a17:90a:1785:: with SMTP id q5mr261402pja.106.1559832402760; Thu, 06 Jun 2019 07:46:42 -0700 (PDT) User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.7.0 Content-Language: en-US X-Mailman-Approved-At: Thu, 06 Jun 2019 10:50:52 -0400 X-Content-Filtered-By: Mailman/MimeDel 2.1.29 X-BeenThere: python-announce-list@python.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Announcement-only list for the Python programming language List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-Mailman-Original-Message-ID: Xref: csiph.com comp.lang.python.announce:3128 On behalf of Twisted Matrix Laboratories, I am honoured to announce the release of Twisted 19.2.1! This is a security release, and contains the following changes: - All HTTP clients in twisted.web.client now raise a ValueError when called with a method and/or URL that contain invalid characters. This mitigates CVE-2019-12387. Thanks to Alex Brasetvik for reporting this vulnerability. It is recommended you update to this release as soon as is practical. Additional mitigation may be required if Twisted is not your only HTTP client library: - This bug is present in all current versions of urllib2 in CPython. More information can be found on the Python bug tracker: https://bugs.python.org/issue30458 - This bug was present in urllib3 up until version 1.24.3. More information can be found on the urllib3 bug tracker: https://github.com/urllib3/urllib3/issues/1553 You can find the downloads at (or alternatively ). The NEWS file is also available at . Twisted Regards, Amber Brown (HawkOwl)