Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.python.announce > #3128 > unrolled thread

[SECURITY] Twisted 19.2.1 Release Announcement

Back to article view | Back to comp.lang.python.announce

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  [SECURITY] Twisted 19.2.1 Release Announcement Amber Brown <hawkowl@atleastfornow.net> - 2019-06-07 00:46 +1000

#3128 — [SECURITY] Twisted 19.2.1 Release Announcement

On behalf of Twisted Matrix Laboratories, I am honoured to announce the 
release of Twisted 19.2.1!

This is a security release, and contains the following changes:

- All HTTP clients in twisted.web.client now raise a ValueError when 
called with a method and/or URL that contain invalid characters. This 
mitigates CVE-2019-12387. Thanks to Alex Brasetvik for reporting this 
vulnerability.

It is recommended you update to this release as soon as is practical.

Additional mitigation may be required if Twisted is not your only HTTP 
client library:

- This bug is present in all current versions of urllib2 in CPython. 
More information can be found on the Python bug tracker: 
https://bugs.python.org/issue30458
- This bug was present in urllib3 up until version 1.24.3. More 
information can be found on the urllib3 bug tracker: 
https://github.com/urllib3/urllib3/issues/1553

You can find the downloads at <https://pypi.python.org/pypi/Twisted> (or 
alternatively <http://twistedmatrix.com/trac/wiki/Downloads>). The NEWS 
file is also available at 
<https://github.com/twisted/twisted/blob/twisted-19.2.1/NEWS.rst>.

Twisted Regards,
Amber Brown (HawkOwl)

[toc] | [standalone]

Back to top | Article view | comp.lang.python.announce

csiph-web