Path: csiph.com!eternal-september.org!feeder.eternal-september.org!aioe.org!bofh.it!news.nic.it!robomod From: Jeremy Stanley Newsgroups: linux.debian.maint.python Subject: Re: python-urllib3 1.25.6 uploaded to experimental (closes CVE-2019-11236) but fails build tests Date: Tue, 29 Oct 2019 14:40:01 +0100 Message-ID: References: X-Original-To: debian-python@lists.debian.org X-Mailbox-Line: From debian-python-request@lists.debian.org Tue Oct 29 13:39:41 2019 Old-Return-Path: X-Amavis-Spam-Status: No, score=-12 tagged_above=-10000 required=5.3 tests=[BAYES_00=-2, LDO_WHITELIST=-5, PGPSIGNATURE=-5] autolearn=ham autolearn_force=no X-Policyd-Weight: using cached result; rate:hard: -4.6 X-Greylist: delayed 1448 seconds by postgrey-1.36 at bendel; Tue, 29 Oct 2019 13:39:30 UTC MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="s6gceay6glemgjkt" Content-Disposition: inline User-Agent: NeoMutt/20170113 (1.7.2) X-Sa-Exim-Connect-IP: 2001:4802:7801:102:be76:4eff:fe20:63e0 X-Sa-Exim-Rcpt-To: debian-python@lists.debian.org X-Sa-Exim-Mail-From: fungi@yuggoth.org X-Sa-Exim-Scanned: No (on azathoth.yuggoth.org); SAEximRunCond expanded to false X-Mailing-List: archive/latest/17527 List-ID: List-URL: List-Archive: https://lists.debian.org/msgid-search/20191029131516.kbq25k7xgumezath@yuggoth.org Approved: robomod@news.nic.it Lines: 56 Organization: linux.* mail to news gateway Sender: robomod@news.nic.it X-Original-Date: Tue, 29 Oct 2019 13:15:17 +0000 X-Original-Message-ID: <20191029131516.kbq25k7xgumezath@yuggoth.org> X-Original-References: <20191027151300.wxpij5kweuy6uw6i@mornie> <6c89d2c7a0e830e0656210f395a8426d@debian.org> Xref: csiph.com linux.debian.maint.python:11966 --s6gceay6glemgjkt Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On 2019-10-29 13:29:02 +0100 (+0100), Michael Kesper wrote: > On 27.10.19 17:27, Drew Parsons wrote: > > On 2019-10-27 23:13, Daniele Tricoli wrote: [...] > > > Not an expert here, but I think fallback is not done on > > > purpose due downgrade attacks: > > > https://en.wikipedia.org/wiki/Downgrade_attack > >=20 > > I see. Still an odd kind of protection though.=C2=A0 The attacker can > > just downgrade themselves. >=20 > No. A sensible server will not talk to you if your requested SSL > version is too low. pub.orcid.org seems to use absolutely outdated > and insecure software versions. Well, downgrade attacks aren't usually a two-party scenario. The risk with a downgrade attack is when a victim client attempts communication with some server, and a third-party attacker tampers with the communication between the client and server sufficiently to cause protocol negotiation to fall back to an old enough version that the attacker can then exploit known flaws to decrypt and/or proxy ("man in the middle") that communication. Having both the client and the server be unwilling to use susceptible older protocol versions helps thwart this attack vector. --=20 Jeremy Stanley --s6gceay6glemgjkt Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQKTBAABCgB9FiEEl65Jb8At7J/DU7LnSPmWEUNJWCkFAl24O15fFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDk3 QUU0OTZGQzAyREVDOUZDMzUzQjJFNzQ4Rjk5NjExNDM0OTU4MjkACgkQSPmWEUNJ WCkvAw/+M4DSwOmjhwbGfSJhzaCftrkd7JDiZnXtyLrMHKIihxL5IONCoew+9dDC XWO6LXNNCv5/SgScPk3xyjf9o3lrKpYr+bioaLxdGggZPiYGLLqek10q8LU5Cjkb xHJtb6a/t8093jDc/3uIix9woKPwVWxqChaxnUFXDuLUakoyfOCtku8D6DcASFUf 5RAJVTZGx6x76qvhhPIaW6bJQKnuylLz81L3bLwZKw8Bo3LQWIds6yxB/twUJ0z0 9cBKtuIDIXWCbc1yW1HAEoY7EX0fjL/WcPdMda+Wy9Yp0N2XLjc31vnNyylWuYc0 t4ntbCizm1uwT0ddvig239ijaqHtpqOa1QnhdSG2WIpQmpfLrS3EOXmZN6walT2o hE/nOmvSDRj8f+ope5aE5iXXcaNxU3zzLfF9jh7YXEbPE6g8czjeLk5ou2abotf7 tyYpwzQqwiHy7FFT7nlbcBm5AG4WJpyTYAeXaz+mC+ijh/uwxb7oeN8RpCsx6co0 4l0PjEeLlvPHeYR8hWzPykNUeYpqEwaxw5VdgcRmAJ8/hc7RBnT4Mgmy4PLPW+TK uwbN5AAmBf0mkM2c20A1eOrsE/ql7RKoogej9a7lKDwcys7iQYpMMgkRbezE3vZh /SWkoy62DqRA5qgUL/bi2xumwj3jPlaqW5ecLlsRj7DSYv38aKI= =u8Lm -----END PGP SIGNATURE----- --s6gceay6glemgjkt--