Path: csiph.com!weretis.net!feeder7.news.weretis.net!news.albasani.net!tahina.priv.at!bofh.it!news.nic.it!robomod From: Daniele Tricoli Newsgroups: linux.debian.maint.python Subject: Re: python-urllib3 1.25.6 uploaded to experimental (closes CVE-2019-11236) but fails build tests Date: Sat, 12 Oct 2019 17:00:02 +0200 Message-ID: References: X-Original-To: debian-python@lists.debian.org X-Mailbox-Line: From debian-python-request@lists.debian.org Sat Oct 12 14:50:38 2019 Old-Return-Path: X-Amavis-Spam-Status: No, score=-12 tagged_above=-10000 required=5.3 tests=[BAYES_00=-2, LDO_WHITELIST=-5, PGPSIGNATURE=-5] autolearn=ham autolearn_force=no X-Policyd-Weight: using cached result; rate: -3.5 X-Greylist: delayed 403 seconds by postgrey-1.36 at bendel; Sat, 12 Oct 2019 14:50:26 UTC Openpgp: preference=signencrypt Autocrypt: addr=eriol@debian.org; keydata= mQINBFTHg7ABEADUFHyhydGlM/n4pqNDMcWBTJSUdmWn+OGYJZfFMgayzcLFL88G6AzUsVWd 4U80WHaT5UHwQehE/t7Bgi/iYiNQF+9iaa/A/VIEMSpaO3+0GBuj6FtzCd4nNynAsO9pKhd+ 7Ubxr53gijVyIO2yu/+y1yUxi35gzvph4orsAhpbKg2A7H9flEwUSWrJP1n4kQXHE1mJpUHo 23wIoR6KZwiQk7qYBOszTdJck7FDFxMQQaWahjoyWz2NICB/NsQ73qRGHDfaL6SDKK51WOJB y4FjKex6nm05tj6tn9pPP3DOKz4n12+QyxOOfoKGzRmPq0PYNMfk6PhjBcUQpWLclAitkedW KWdM+7PePEBKV5e4uiLlxESWteIPXa+9bcFXYlgdr9wT3Kk9ZuZD44hg42w4QOvcD2i6/BOG Tzf9yQ7d4GIiY5gaMjd9vxSEPrAT42aBpH5okztNGVXGd1+zPAQ2S9hARTqvHFEbbJA3ORYP VMdI5EHkwxunsKbnXBPzyyC0gkShb37PNl473djTMebX4y+xATeO98mpFGX/z0t/+r+PCWZ1 ZmsfGNJAN4FS3T5EffOFgg4R2ujYankICg6kNTppJzulSjUiolvln9kJp1Jmq803pdSRcltf b4/8nD2C6fQjV272kTvCtmKeM2GSMDvAPggvjbZCpjVo7rwRqwARAQABtCJEYW5pZWxlIFRy aWNvbGkgPGVyaW9sQGRlYmlhbi5vcmc+iQJUBBMBCgA+FiEExlrvn+W/jMvW7bAZi69SLA1s zt0FAlwli90CGwMFCRLMAwAFCwkIBwMFFQoJCAsFFgIDAQACHgECF4AACgkQi69SLA1szt3r Uw/9G+kSWj46bfy9hNA3bwe0puY1L9JZ/zZIFuAmQ4U82gOcMIdYXytXZHIbS5YPEM8jw8uc uvUxjV3THFtSf9lj53Y9zt1zA6u7FDFy6PefeLHV2QxHjkDejzc3qu6xh9AIst4hs2LvZLIy gZSMSuieviAscMqpEPrqSv3OBmz5zX2t6+tvLl7OB5vF7psko8VAb0a6a7+MaCR3eEdBMccu V63CKqEL5kNDOmfhUQSHTENAhrTaNxh1/8nwiuJUR1gYWPr3AAe7zoptThREyNTzTFKE/3I4 Ca0cNGdW0ugnIPS6ETDKl+rTomJ6iq4qe8jbtoiA6U/kFRJu/w4rduhejwEqXhy+QaHxd5Cl 1sSQGh0V3S7XStAA3dN3phTVDaAqS5uMybfiIlwMhwBEXA4f0ITNrvXn+/ANt8N8zhsl2q0k 57ySIg24a8piteM9nYLXrb63dpz0fsVWVO8xHzm73qKz3vrULQCOESMCPQXMxz72R0G1BSV7 mFPb1jxWt96wemhqS+yDbu/I3xfjpxjIdlDzQRAwy/8r0lYRx57yblfjXSGxit2jVvFkCEYL q32nkZ/lSMibs2xnKdEunlp6VsGbau730SbxjAZeaHsqQLiOZ6DpFLY3CuaeUT+VrC4VONjS Ygb/33jZrhNFD2jCKZlNIkciDe4xCOUeyUesNk25Ag0EVMeDsAEQALPZcGjYCiB0avI4yMg1 86VfH3dGEA3J4TSkS4ks5/Bff2DNC/3EV10Y+Chpq1VM7uIL0S5Ee4n+n5BsRyKqy/RvVdqI 8CSZxvza2kg/K22moOFFU/MWDNdkuuJEJthgnAm9RYlGCrE8rC8SidZi1rnBZfbBdknldUdn aeZULvWXH2h2wcFCZk2lSg7cODcxHCRbwDJzLEA3gIAlb6KbKEkp+Nn5U7V6v+5NLzeouB2n qmnUPhtk4bDFSNT258xcXqR/S3UNMdVqPTi4kVKWzYoe/DC5Ofqv65qULEhzdqaBbZcPZw7+ rt1SGfooJzs+mgr+rne/UGQxs4di9GSUJbqBHZspWQ1wBbEMTNuiG58V5BOUo/feQcEKOe6T 9tcPeaoQvVKhKpmioSJFyGdgIrGveDXXdK6xbwwl+/9tWUaEORjSZSIKrR2iNVcMRlTi8YF4 CuL/4CnkSFb7Et29GMiwZoH8akrgw3x2t+GHXe262xY5i9/7+j/mVza6KHZUZHEm69iS/KpS b5Hgf0u8COuhHKjsdvv3FSv11yx8CTzgL3J04BaQgxK8lzJw39b5q6gnCsE/HQtqJfzDTuOD Qn7uNj08ptWTwhqgKcdu34JqSnwujxwvCC92SodOXS81n7+KVwbD+C/uB/xZ0cJfDBs/M2pW zKZ7mPzKJqaTXuZbABEBAAGJAiUEGAEIAA8FAlTHg7ACGwwFCRLMAwAACgkQi69SLA1szt3B VA//Xr7qpe4rPbhv4xeoPmBezd4CnXAC+34ko61rEXD4LMP2ChzXZc6qWcMpD46/vGtBu9X6 DmmqOrsDPjH3qUVhLdv8QKMsoxo71P2j0b6n86KabaiGH7oaJj8GQfXq1DC4FzuNGDB7D3Pg JAVwrkiVMHLiQ3YnaYK2txBCc2HR3CmNkBebd/t4Uhki72LuP9zevOvSnYJx+86Yt3UFubqH GtT4IH+iJMD43cjGXjaxtL3KBnyagiOgxNPQspWGcQ+Jjw/R3a+jJzkaBG6lrl9mERnOpNB+ SSlfuFBRiws0tNS0boRujzBdgWOnVIkZnY/MSCtXshYkC0qm/eVhioo4XqBnhSboYfAYEvM1 oNAeVLLrLZ1pIU7J4vONDlEy74bWQ3H4YQ4gdG6tqmwg/mN5FIMq9ivialJxpLuww7o5S18p IspI2PpLfr1uT3O4aHFvKMY1AQu8IfZ4FjXHK+0O6yIuHm/b2tGVwTfj/t66HQ1wbRizTT15 ZSKi1ab33ZsbbItf06G8VE0LQj9anCmN6ReeKwX33cuUG3zZlwaS7HO6lkaamPHOW6klkySS CZGryrpOvqLpflgPWMxUbmZkNkMS0n39Cfm+90LSvp1kyUuh6sTkJpM5A7+Pyf1WdwkZDJ17 A0faRNPpmTsynhEMh/bQnGW83ld9ZEOnSmFFhHQ= User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.9.0 MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="t1zaCZ3iWCBnIJGzZaluxN5un8yFeDIQy" X-Mailing-List: archive/latest/17425 List-ID: List-URL: List-Archive: https://lists.debian.org/msgid-search/a69852d4-2690-a93e-5d7d-53538c3b6c5b@debian.org Approved: robomod@news.nic.it Lines: 91 Organization: linux.* mail to news gateway Sender: robomod@news.nic.it X-Original-Date: Sat, 12 Oct 2019 16:43:30 +0200 X-Original-Message-ID: X-Original-References: <29540518957e112449aee72d1c5d2622@debian.org> Xref: csiph.com linux.debian.maint.python:11881 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --t1zaCZ3iWCBnIJGzZaluxN5un8yFeDIQy Content-Type: multipart/mixed; boundary="lbXxT1pjIHSiSdln7K2oRar5zSkJjTTVE"; protected-headers="v1" From: Daniele Tricoli To: debian-python@lists.debian.org Message-ID: Subject: Re: python-urllib3 1.25.6 uploaded to experimental (closes CVE-2019-11236) but fails build tests References: <29540518957e112449aee72d1c5d2622@debian.org> In-Reply-To: <29540518957e112449aee72d1c5d2622@debian.org> --lbXxT1pjIHSiSdln7K2oRar5zSkJjTTVE Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: quoted-printable Hi Drew, On 12/10/2019 07:57, Drew Parsons wrote: > Hi Daniele, just letting you know I uploaded python-urllib3 1.25.6 to > experimental. Thanks for taking care of urllib3. > I was having some SSL trouble connecting to https://pub.orcid.org.=C2=A0= The error > trace cited urllib3/contrib/pyopenssl.py, so I downloaded and installed= > python-urllib3 1.25.6 to see if updates to default SSL/TLS versions mad= e any > difference.=C2=A0 It didn't fix my problem, but since I had the package= update ready > I figured I might as well present it to experimental. I hope to have the time to investigate also this: urllib3/contrib/pyopens= sl.py contains code to have SSL with SNI_-support for Python 2 and it depends o= n pyOpenSSL, cryptography and idna. Maybe looking at them can give us more = clues. Also, could you see if using Python3 the connection to https://pub.orcid.= org work? > The new version fixes CVE-2019-11236 (Bug#927172).=C2=A0 As far as I ca= n tell it > also fixes CVE-2019-11324 (Bug#927412), but I figured it's best to let = you > review that. >=20 > Th package build was successful on my system but gives build-time error= s in > chroot (on buildd).=C2=A0 I'm not sure why that's failing. I will look at them during this weekend, I already had a look at build lo= g from the phone, but it's better to look from a PC. Regards, --=20 Daniele Tricoli 'eriol' https://mornie.org --lbXxT1pjIHSiSdln7K2oRar5zSkJjTTVE-- --t1zaCZ3iWCBnIJGzZaluxN5un8yFeDIQy Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEExlrvn+W/jMvW7bAZi69SLA1szt0FAl2h5psACgkQi69SLA1s zt2GAQ/7Bz7v7g+GFfkSOsUi0+8pfYB1V5VsLUo4XjgWc8S9exLid7mpqYLZ3B+K nqOMm93FWY9EIU/hi+oKk7gkAQdv+DFg9veA+fiOhxmHJcoO3oei9H33YlJLM4Cz 2dDgxWReI6xP0jpfUiItuBiHIfeacEwfC/xfIz026IFw/sBbKVkaGdutKbC8kGH9 c7HkJ9hhC5YIBQ6qmE7XKj8EWqAqSYY1p5CouQ3yQo2Xn5zjVy4730U58njsbQo3 D/Kl/WuVcBB44yaFLAb6xus77Ro2uptgXvo+Z+VnfPQmkZxkrt4U/b2Ciwr1s0ft quSzCNvjg79sUYdA47Hy96NEsfw/GRTlf+pKs+DzKUexAsFbzfSO0LbVjfm+hX3f 8LX8ONcnoiflF2g3biYHjKxtcFlgvzCvkTABoschDQMsHImuXzne2TPMxMV2yMZl PVbCSNR7+jtOENCzoypeUv9MojLl9L1CC54hIaHZuDQAoHV97kR/ncF/AytLVDLs +U4hd0/8gmSbTm86Wbbh3EdbO1dQFQVx3A7khQr/Y6A/hPXkv5zEOSzOhb2QKfZV 0Oy0BEP/1zCLy5LAHnaWXLvtqY3tJRxHsu/daUHwGLOSOsKfQ4TWcQfB0+U/D1jg 58VDBqXZn+9f5x9DmIDujE8a/mdW0mGVwx29LDFoaLg+0w+T26A= =7o6l -----END PGP SIGNATURE----- --t1zaCZ3iWCBnIJGzZaluxN5un8yFeDIQy--