Groups > linux.debian.maint.python > #11965

Re: python-urllib3 1.25.6 uploaded to experimental (closes CVE-2019-11236) but fails build tests

Path	csiph.com!news.mixmin.net!aioe.org!bofh.it!news.nic.it!robomod
From	Ondrej Novy <novy@ondrej.org>
Newsgroups	linux.debian.maint.python
Subject	Re: python-urllib3 1.25.6 uploaded to experimental (closes CVE-2019-11236) but fails build tests
Date	Tue, 29 Oct 2019 14:20:01 +0100
Message-ID	<yWzzH-73-7@gated-at.bofh.it> (permalink)
References	<yQNcl-6C9-3@gated-at.bofh.it> <yVSEp-5GA-3@gated-at.bofh.it> <yVTAu-6fF-5@gated-at.bofh.it> <yWyNj-81M-1@gated-at.bofh.it>
X-Mailbox-Line	From debian-python-request@lists.debian.org Tue Oct 29 13:18:08 2019
Old-Return-Path	<ondrej.novy@gmail.com>
X-Amavis-Spam-Status	No, score=-4.749 tagged_above=-10000 required=5.3 tests=[BAYES_00=-2, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, FREEMAIL_FORGED_FROMDOMAIN=0.001, FREEMAIL_FROM=0.001, HEADER_FROM_DIFFERENT_DOMAINS=0.249, HTML_MESSAGE=2, LDO_WHITELIST=-5, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=no autolearn_force=no
X-Policyd-Weight	using cached result; rate: -5.5
Dkim-Signature	v=1; a=rsa-sha256; c=relaxed/relaxed; d=ondrej-org.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=If+fc0o7o6E1UOpRaynZA7hOUB/peLh8/uAYEYe4Gyc=; b=w6Z1Jlwq6FjqmyhXlmjL/6ce/WINLvXuP132HjxJ974zgbn6DSTVc3bOiv6AuTalBA yx/IEstHuZHGmci/u3+9FJRLOOE6A8qrDcNspKQqHNoln0q60OhrkjspeXlcTcBeYAgR F63gKLpzp6IUlo99dT8jjyrIFGtxLxSlp6b0IYvNs5i8EsujCZu674RGWQ50d8HkWxn+ F9vMIj8palCoOZzEmyOTOh8RwfqxS4ridmXm3xcOjW2FhYOan0ZBoQC1tgxsyVEeVTct SghlkhzTSaXdAH3soea1u78pmvLZSyOwEdCTR1PgdTsh0kGVKWC6vuJltieMgfKXC2oD GD0A==
X-Google-Dkim-Signature	v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=If+fc0o7o6E1UOpRaynZA7hOUB/peLh8/uAYEYe4Gyc=; b=lhTyV+99umuBKGiojp7Nf1cjywvYXJXgQ+FFcPDpsf6zrux7gqJG1TvxRLtfVKfgJ0 kWgeJpCBhPQE0AXkAS9Nj3DLYiCjmJshFXcQSPDPmp3sZAtWXyXLyALv3b0sPXddb9D2 PmKI0PfNabYX39LYiXHHkOkDy5aHnFrbWzZ9POSznh8KkNaHya5b//DjeHCuWX7Rn/9u Og4t9LL9nyQ1qK6MKAN+UvR7h9NclDcJEihob9T0TfmV2rP+kijvh0gDdDQAGaDkhoeI HgeJHlmHGc1eCSdD/3a7Fps5CqEvcWmN7Hhs7VambmI9cAZurT9gfHg7JGaBEaxM4b4k Id9A==
X-Gm-Message-State	APjAAAUAo+7uWlKPPH2slXhUZkUdQot6Uqv9Fmb04GSekZUhI+UlpC7a 0e5AYzpMrOYzPb3rwSZ4ZRNJY8GWz0N52JdMzXtfeckX
X-Google-SMTP-Source	APXvYqzOr1pu+QFHYSoz0STXaX3MiXgituLy+qEAVEU0zRrc0tdlPtbWMm4Q9ygF75TttoYQx4HdLstLNwxUbje2lGo=
X-Received	by 2002:a05:6102:80f:: with SMTP id g15mr629585vsb.229.1572354101413; Tue, 29 Oct 2019 06:01:41 -0700 (PDT)
MIME-Version	1.0
Content-Type	multipart/alternative; boundary="000000000000ad0fdc05960c37fa"
X-Mailing-List	<debian-python@lists.debian.org> archive/latest/17526
List-ID	<debian-python.lists.debian.org>
List-URL	<https://lists.debian.org/debian-python/>
List-Archive	https://lists.debian.org/msgid-search/CAOO6c=wnXQLUFJKwj3pyATR2-zUM0EJz6zzFFrX1qxnOXg1RPg@mail.gmail.com
Approved	robomod@news.nic.it
Lines	53
Organization	linux.* mail to news gateway
Sender	robomod@news.nic.it
X-Original-Cc	debian-python <debian-python@lists.debian.org>
X-Original-Date	Tue, 29 Oct 2019 14:01:29 +0100
X-Original-Message-ID	<CAOO6c=wnXQLUFJKwj3pyATR2-zUM0EJz6zzFFrX1qxnOXg1RPg@mail.gmail.com>
X-Original-References	<bb131949c409df06cbb4725cb125771e@debian.org> <20191027151300.wxpij5kweuy6uw6i@mornie> <6c89d2c7a0e830e0656210f395a8426d@debian.org> <e6ffc518-4329-54aa-acd2-05a242c1de05@schokokeks.org>
Xref	csiph.com linux.debian.maint.python:11965

Show key headers only | View raw

[Multipart message — attachments visible in raw view] - view raw

Hi,

út 29. 10. 2019 v 13:29 odesílatel Michael Kesper <mkesper@schokokeks.org>
napsal:

> > I see. Still an odd kind of protection though.  The attacker can just
> downgrade themselves.
>
> No. A sensible server will not talk to you if your requested SSL version
> is too low.
> pub.orcid.org seems to use absolutely outdated and insecure software
> versions.
>

right. If you want good security, you need to limit TLS version on both
side (client-urlib3 and server-whatever). Than downgrade attack is not
possible.

-- 
Best regards
 Ondřej Nový

Thread

Re: python-urllib3 1.25.6 uploaded to experimental (closes  CVE-2019-11236) but fails build tests Drew Parsons <dparsons@debian.org> - 2019-10-13 16:40 +0200
  Re: python-urllib3 1.25.6 uploaded to experimental (closes  CVE-2019-11236) but fails build tests Daniele Tricoli <eriol@debian.org> - 2019-10-27 16:30 +0100
    Re: python-urllib3 1.25.6 uploaded to experimental (closes  CVE-2019-11236) but fails build tests Drew Parsons <dparsons@debian.org> - 2019-10-27 17:30 +0100
      Re: python-urllib3 1.25.6 uploaded to experimental (closes  CVE-2019-11236) but fails build tests Michael Kesper <mkesper@schokokeks.org> - 2019-10-29 13:30 +0100
        Re: python-urllib3 1.25.6 uploaded to experimental (closes  CVE-2019-11236) but fails build tests Ondrej Novy <novy@ondrej.org> - 2019-10-29 14:20 +0100
        Re: python-urllib3 1.25.6 uploaded to experimental (closes  CVE-2019-11236) but fails build tests Jeremy Stanley <fungi@yuggoth.org> - 2019-10-29 14:40 +0100
          Re: python-urllib3 1.25.6 uploaded to experimental (closes  CVE-2019-11236) but fails build tests Michael Kesper <mkesper@schokokeks.org> - 2019-10-29 15:40 +0100

csiph-web