Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.maint.python > #11881
| Path | csiph.com!weretis.net!feeder7.news.weretis.net!news.albasani.net!tahina.priv.at!bofh.it!news.nic.it!robomod |
|---|---|
| From | Daniele Tricoli <eriol@debian.org> |
| Newsgroups | linux.debian.maint.python |
| Subject | Re: python-urllib3 1.25.6 uploaded to experimental (closes CVE-2019-11236) but fails build tests |
| Date | Sat, 12 Oct 2019 17:00:02 +0200 |
| Message-ID | <yQr2a-Ho-5@gated-at.bofh.it> (permalink) |
| References | <yQiLf-4aC-1@gated-at.bofh.it> |
| X-Original-To | debian-python@lists.debian.org |
| X-Mailbox-Line | From debian-python-request@lists.debian.org Sat Oct 12 14:50:38 2019 |
| Old-Return-Path | <eriol@debian.org> |
| X-Amavis-Spam-Status | No, score=-12 tagged_above=-10000 required=5.3 tests=[BAYES_00=-2, LDO_WHITELIST=-5, PGPSIGNATURE=-5] autolearn=ham autolearn_force=no |
| X-Policyd-Weight | using cached result; rate: -3.5 |
| X-Greylist | delayed 403 seconds by postgrey-1.36 at bendel; Sat, 12 Oct 2019 14:50:26 UTC |
| Openpgp | preference=signencrypt |
| Autocrypt | addr=eriol@debian.org; keydata= mQINBFTHg7ABEADUFHyhydGlM/n4pqNDMcWBTJSUdmWn+OGYJZfFMgayzcLFL88G6AzUsVWd 4U80WHaT5UHwQehE/t7Bgi/iYiNQF+9iaa/A/VIEMSpaO3+0GBuj6FtzCd4nNynAsO9pKhd+ 7Ubxr53gijVyIO2yu/+y1yUxi35gzvph4orsAhpbKg2A7H9flEwUSWrJP1n4kQXHE1mJpUHo 23wIoR6KZwiQk7qYBOszTdJck7FDFxMQQaWahjoyWz2NICB/NsQ73qRGHDfaL6SDKK51WOJB y4FjKex6nm05tj6tn9pPP3DOKz4n12+QyxOOfoKGzRmPq0PYNMfk6PhjBcUQpWLclAitkedW KWdM+7PePEBKV5e4uiLlxESWteIPXa+9bcFXYlgdr9wT3Kk9ZuZD44hg42w4QOvcD2i6/BOG Tzf9yQ7d4GIiY5gaMjd9vxSEPrAT42aBpH5okztNGVXGd1+zPAQ2S9hARTqvHFEbbJA3ORYP VMdI5EHkwxunsKbnXBPzyyC0gkShb37PNl473djTMebX4y+xATeO98mpFGX/z0t/+r+PCWZ1 ZmsfGNJAN4FS3T5EffOFgg4R2ujYankICg6kNTppJzulSjUiolvln9kJp1Jmq803pdSRcltf b4/8nD2C6fQjV272kTvCtmKeM2GSMDvAPggvjbZCpjVo7rwRqwARAQABtCJEYW5pZWxlIFRy aWNvbGkgPGVyaW9sQGRlYmlhbi5vcmc+iQJUBBMBCgA+FiEExlrvn+W/jMvW7bAZi69SLA1s zt0FAlwli90CGwMFCRLMAwAFCwkIBwMFFQoJCAsFFgIDAQACHgECF4AACgkQi69SLA1szt3r Uw/9G+kSWj46bfy9hNA3bwe0puY1L9JZ/zZIFuAmQ4U82gOcMIdYXytXZHIbS5YPEM8jw8uc uvUxjV3THFtSf9lj53Y9zt1zA6u7FDFy6PefeLHV2QxHjkDejzc3qu6xh9AIst4hs2LvZLIy gZSMSuieviAscMqpEPrqSv3OBmz5zX2t6+tvLl7OB5vF7psko8VAb0a6a7+MaCR3eEdBMccu V63CKqEL5kNDOmfhUQSHTENAhrTaNxh1/8nwiuJUR1gYWPr3AAe7zoptThREyNTzTFKE/3I4 Ca0cNGdW0ugnIPS6ETDKl+rTomJ6iq4qe8jbtoiA6U/kFRJu/w4rduhejwEqXhy+QaHxd5Cl 1sSQGh0V3S7XStAA3dN3phTVDaAqS5uMybfiIlwMhwBEXA4f0ITNrvXn+/ANt8N8zhsl2q0k 57ySIg24a8piteM9nYLXrb63dpz0fsVWVO8xHzm73qKz3vrULQCOESMCPQXMxz72R0G1BSV7 mFPb1jxWt96wemhqS+yDbu/I3xfjpxjIdlDzQRAwy/8r0lYRx57yblfjXSGxit2jVvFkCEYL q32nkZ/lSMibs2xnKdEunlp6VsGbau730SbxjAZeaHsqQLiOZ6DpFLY3CuaeUT+VrC4VONjS Ygb/33jZrhNFD2jCKZlNIkciDe4xCOUeyUesNk25Ag0EVMeDsAEQALPZcGjYCiB0avI4yMg1 86VfH3dGEA3J4TSkS4ks5/Bff2DNC/3EV10Y+Chpq1VM7uIL0S5Ee4n+n5BsRyKqy/RvVdqI 8CSZxvza2kg/K22moOFFU/MWDNdkuuJEJthgnAm9RYlGCrE8rC8SidZi1rnBZfbBdknldUdn aeZULvWXH2h2wcFCZk2lSg7cODcxHCRbwDJzLEA3gIAlb6KbKEkp+Nn5U7V6v+5NLzeouB2n qmnUPhtk4bDFSNT258xcXqR/S3UNMdVqPTi4kVKWzYoe/DC5Ofqv65qULEhzdqaBbZcPZw7+ rt1SGfooJzs+mgr+rne/UGQxs4di9GSUJbqBHZspWQ1wBbEMTNuiG58V5BOUo/feQcEKOe6T 9tcPeaoQvVKhKpmioSJFyGdgIrGveDXXdK6xbwwl+/9tWUaEORjSZSIKrR2iNVcMRlTi8YF4 CuL/4CnkSFb7Et29GMiwZoH8akrgw3x2t+GHXe262xY5i9/7+j/mVza6KHZUZHEm69iS/KpS b5Hgf0u8COuhHKjsdvv3FSv11yx8CTzgL3J04BaQgxK8lzJw39b5q6gnCsE/HQtqJfzDTuOD Qn7uNj08ptWTwhqgKcdu34JqSnwujxwvCC92SodOXS81n7+KVwbD+C/uB/xZ0cJfDBs/M2pW zKZ7mPzKJqaTXuZbABEBAAGJAiUEGAEIAA8FAlTHg7ACGwwFCRLMAwAACgkQi69SLA1szt3B VA//Xr7qpe4rPbhv4xeoPmBezd4CnXAC+34ko61rEXD4LMP2ChzXZc6qWcMpD46/vGtBu9X6 DmmqOrsDPjH3qUVhLdv8QKMsoxo71P2j0b6n86KabaiGH7oaJj8GQfXq1DC4FzuNGDB7D3Pg JAVwrkiVMHLiQ3YnaYK2txBCc2HR3CmNkBebd/t4Uhki72LuP9zevOvSnYJx+86Yt3UFubqH GtT4IH+iJMD43cjGXjaxtL3KBnyagiOgxNPQspWGcQ+Jjw/R3a+jJzkaBG6lrl9mERnOpNB+ SSlfuFBRiws0tNS0boRujzBdgWOnVIkZnY/MSCtXshYkC0qm/eVhioo4XqBnhSboYfAYEvM1 oNAeVLLrLZ1pIU7J4vONDlEy74bWQ3H4YQ4gdG6tqmwg/mN5FIMq9ivialJxpLuww7o5S18p IspI2PpLfr1uT3O4aHFvKMY1AQu8IfZ4FjXHK+0O6yIuHm/b2tGVwTfj/t66HQ1wbRizTT15 ZSKi1ab33ZsbbItf06G8VE0LQj9anCmN6ReeKwX33cuUG3zZlwaS7HO6lkaamPHOW6klkySS CZGryrpOvqLpflgPWMxUbmZkNkMS0n39Cfm+90LSvp1kyUuh6sTkJpM5A7+Pyf1WdwkZDJ17 A0faRNPpmTsynhEMh/bQnGW83ld9ZEOnSmFFhHQ= |
| User-Agent | Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.9.0 |
| MIME-Version | 1.0 |
| Content-Type | multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="t1zaCZ3iWCBnIJGzZaluxN5un8yFeDIQy" |
| X-Mailing-List | <debian-python@lists.debian.org> archive/latest/17425 |
| List-ID | <debian-python.lists.debian.org> |
| List-URL | <https://lists.debian.org/debian-python/> |
| List-Archive | https://lists.debian.org/msgid-search/a69852d4-2690-a93e-5d7d-53538c3b6c5b@debian.org |
| Approved | robomod@news.nic.it |
| Lines | 91 |
| Organization | linux.* mail to news gateway |
| Sender | robomod@news.nic.it |
| X-Original-Date | Sat, 12 Oct 2019 16:43:30 +0200 |
| X-Original-Message-ID | <a69852d4-2690-a93e-5d7d-53538c3b6c5b@debian.org> |
| X-Original-References | <29540518957e112449aee72d1c5d2622@debian.org> |
| Xref | csiph.com linux.debian.maint.python:11881 |
Show key headers only | View raw
[Multipart message — attachments visible in raw view] - view raw
Hi Drew, On 12/10/2019 07:57, Drew Parsons wrote: > Hi Daniele, just letting you know I uploaded python-urllib3 1.25.6 to > experimental. Thanks for taking care of urllib3. > I was having some SSL trouble connecting to https://pub.orcid.org. The error > trace cited urllib3/contrib/pyopenssl.py, so I downloaded and installed > python-urllib3 1.25.6 to see if updates to default SSL/TLS versions made any > difference. It didn't fix my problem, but since I had the package update ready > I figured I might as well present it to experimental. I hope to have the time to investigate also this: urllib3/contrib/pyopenssl.py contains code to have SSL with SNI_-support for Python 2 and it depends on pyOpenSSL, cryptography and idna. Maybe looking at them can give us more clues. Also, could you see if using Python3 the connection to https://pub.orcid.org work? > The new version fixes CVE-2019-11236 (Bug#927172). As far as I can tell it > also fixes CVE-2019-11324 (Bug#927412), but I figured it's best to let you > review that. > > Th package build was successful on my system but gives build-time errors in > chroot (on buildd). I'm not sure why that's failing. I will look at them during this weekend, I already had a look at build log from the phone, but it's better to look from a PC. Regards, -- Daniele Tricoli 'eriol' https://mornie.org
Back to linux.debian.maint.python | Previous | Next — Previous in thread | Find similar | Unroll thread
python-urllib3 1.25.6 uploaded to experimental (closes CVE-2019-11236) but fails build tests Drew Parsons <dparsons@debian.org> - 2019-10-12 08:10 +0200 Re: python-urllib3 1.25.6 uploaded to experimental (closes CVE-2019-11236) but fails build tests Daniele Tricoli <eriol@debian.org> - 2019-10-12 17:00 +0200
csiph-web