Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.maint.python > #11966
| Path | csiph.com!eternal-september.org!feeder.eternal-september.org!aioe.org!bofh.it!news.nic.it!robomod |
|---|---|
| From | Jeremy Stanley <fungi@yuggoth.org> |
| Newsgroups | linux.debian.maint.python |
| Subject | Re: python-urllib3 1.25.6 uploaded to experimental (closes CVE-2019-11236) but fails build tests |
| Date | Tue, 29 Oct 2019 14:40:01 +0100 |
| Message-ID | <yWzT3-dY-7@gated-at.bofh.it> (permalink) |
| References | <yQNcl-6C9-3@gated-at.bofh.it> <yVSEp-5GA-3@gated-at.bofh.it> <yVTAu-6fF-5@gated-at.bofh.it> <yWyNj-81M-1@gated-at.bofh.it> |
| X-Original-To | debian-python@lists.debian.org |
| X-Mailbox-Line | From debian-python-request@lists.debian.org Tue Oct 29 13:39:41 2019 |
| Old-Return-Path | <fungi@yuggoth.org> |
| X-Amavis-Spam-Status | No, score=-12 tagged_above=-10000 required=5.3 tests=[BAYES_00=-2, LDO_WHITELIST=-5, PGPSIGNATURE=-5] autolearn=ham autolearn_force=no |
| X-Policyd-Weight | using cached result; rate:hard: -4.6 |
| X-Greylist | delayed 1448 seconds by postgrey-1.36 at bendel; Tue, 29 Oct 2019 13:39:30 UTC |
| MIME-Version | 1.0 |
| Content-Type | multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="s6gceay6glemgjkt" |
| Content-Disposition | inline |
| User-Agent | NeoMutt/20170113 (1.7.2) |
| X-Sa-Exim-Connect-IP | 2001:4802:7801:102:be76:4eff:fe20:63e0 |
| X-Sa-Exim-Rcpt-To | debian-python@lists.debian.org |
| X-Sa-Exim-Mail-From | fungi@yuggoth.org |
| X-Sa-Exim-Scanned | No (on azathoth.yuggoth.org); SAEximRunCond expanded to false |
| X-Mailing-List | <debian-python@lists.debian.org> archive/latest/17527 |
| List-ID | <debian-python.lists.debian.org> |
| List-URL | <https://lists.debian.org/debian-python/> |
| List-Archive | https://lists.debian.org/msgid-search/20191029131516.kbq25k7xgumezath@yuggoth.org |
| Approved | robomod@news.nic.it |
| Lines | 56 |
| Organization | linux.* mail to news gateway |
| Sender | robomod@news.nic.it |
| X-Original-Date | Tue, 29 Oct 2019 13:15:17 +0000 |
| X-Original-Message-ID | <20191029131516.kbq25k7xgumezath@yuggoth.org> |
| X-Original-References | <bb131949c409df06cbb4725cb125771e@debian.org> <20191027151300.wxpij5kweuy6uw6i@mornie> <6c89d2c7a0e830e0656210f395a8426d@debian.org> <e6ffc518-4329-54aa-acd2-05a242c1de05@schokokeks.org> |
| Xref | csiph.com linux.debian.maint.python:11966 |
Show key headers only | View raw
[Multipart message — attachments visible in raw view] - view raw
On 2019-10-29 13:29:02 +0100 (+0100), Michael Kesper wrote:
> On 27.10.19 17:27, Drew Parsons wrote:
> > On 2019-10-27 23:13, Daniele Tricoli wrote:
[...]
> > > Not an expert here, but I think fallback is not done on
> > > purpose due downgrade attacks:
> > > https://en.wikipedia.org/wiki/Downgrade_attack
> >
> > I see. Still an odd kind of protection though. The attacker can
> > just downgrade themselves.
>
> No. A sensible server will not talk to you if your requested SSL
> version is too low. pub.orcid.org seems to use absolutely outdated
> and insecure software versions.
Well, downgrade attacks aren't usually a two-party scenario. The
risk with a downgrade attack is when a victim client attempts
communication with some server, and a third-party attacker tampers
with the communication between the client and server sufficiently to
cause protocol negotiation to fall back to an old enough version
that the attacker can then exploit known flaws to decrypt and/or
proxy ("man in the middle") that communication. Having both the
client and the server be unwilling to use susceptible older protocol
versions helps thwart this attack vector.
--
Jeremy Stanley
Back to linux.debian.maint.python | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
Re: python-urllib3 1.25.6 uploaded to experimental (closes CVE-2019-11236) but fails build tests Drew Parsons <dparsons@debian.org> - 2019-10-13 16:40 +0200
Re: python-urllib3 1.25.6 uploaded to experimental (closes CVE-2019-11236) but fails build tests Daniele Tricoli <eriol@debian.org> - 2019-10-27 16:30 +0100
Re: python-urllib3 1.25.6 uploaded to experimental (closes CVE-2019-11236) but fails build tests Drew Parsons <dparsons@debian.org> - 2019-10-27 17:30 +0100
Re: python-urllib3 1.25.6 uploaded to experimental (closes CVE-2019-11236) but fails build tests Michael Kesper <mkesper@schokokeks.org> - 2019-10-29 13:30 +0100
Re: python-urllib3 1.25.6 uploaded to experimental (closes CVE-2019-11236) but fails build tests Ondrej Novy <novy@ondrej.org> - 2019-10-29 14:20 +0100
Re: python-urllib3 1.25.6 uploaded to experimental (closes CVE-2019-11236) but fails build tests Jeremy Stanley <fungi@yuggoth.org> - 2019-10-29 14:40 +0100
Re: python-urllib3 1.25.6 uploaded to experimental (closes CVE-2019-11236) but fails build tests Michael Kesper <mkesper@schokokeks.org> - 2019-10-29 15:40 +0100
csiph-web