Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.maint.python > #11965

Re: python-urllib3 1.25.6 uploaded to experimental (closes CVE-2019-11236) but fails build tests

From Ondrej Novy <novy@ondrej.org>
Newsgroups linux.debian.maint.python
Subject Re: python-urllib3 1.25.6 uploaded to experimental (closes CVE-2019-11236) but fails build tests
Date 2019-10-29 14:20 +0100
Message-ID <yWzzH-73-7@gated-at.bofh.it> (permalink)
References <yQNcl-6C9-3@gated-at.bofh.it> <yVSEp-5GA-3@gated-at.bofh.it> <yVTAu-6fF-5@gated-at.bofh.it> <yWyNj-81M-1@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

Hi,

út 29. 10. 2019 v 13:29 odesílatel Michael Kesper <mkesper@schokokeks.org>
napsal:

> > I see. Still an odd kind of protection though.  The attacker can just
> downgrade themselves.
>
> No. A sensible server will not talk to you if your requested SSL version
> is too low.
> pub.orcid.org seems to use absolutely outdated and insecure software
> versions.
>

right. If you want good security, you need to limit TLS version on both
side (client-urlib3 and server-whatever). Than downgrade attack is not
possible.

-- 
Best regards
 Ondřej Nový

Back to linux.debian.maint.python | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Re: python-urllib3 1.25.6 uploaded to experimental (closes  CVE-2019-11236) but fails build tests Drew Parsons <dparsons@debian.org> - 2019-10-13 16:40 +0200
  Re: python-urllib3 1.25.6 uploaded to experimental (closes  CVE-2019-11236) but fails build tests Daniele Tricoli <eriol@debian.org> - 2019-10-27 16:30 +0100
    Re: python-urllib3 1.25.6 uploaded to experimental (closes  CVE-2019-11236) but fails build tests Drew Parsons <dparsons@debian.org> - 2019-10-27 17:30 +0100
      Re: python-urllib3 1.25.6 uploaded to experimental (closes  CVE-2019-11236) but fails build tests Michael Kesper <mkesper@schokokeks.org> - 2019-10-29 13:30 +0100
        Re: python-urllib3 1.25.6 uploaded to experimental (closes  CVE-2019-11236) but fails build tests Ondrej Novy <novy@ondrej.org> - 2019-10-29 14:20 +0100
        Re: python-urllib3 1.25.6 uploaded to experimental (closes  CVE-2019-11236) but fails build tests Jeremy Stanley <fungi@yuggoth.org> - 2019-10-29 14:40 +0100
          Re: python-urllib3 1.25.6 uploaded to experimental (closes  CVE-2019-11236) but fails build tests Michael Kesper <mkesper@schokokeks.org> - 2019-10-29 15:40 +0100

csiph-web