Path: csiph.com!news.mixmin.net!aioe.org!bofh.it!news.nic.it!robomod From: Ondrej Novy Newsgroups: linux.debian.maint.python Subject: Re: python-urllib3 1.25.6 uploaded to experimental (closes CVE-2019-11236) but fails build tests Date: Tue, 29 Oct 2019 14:20:01 +0100 Message-ID: References: X-Mailbox-Line: From debian-python-request@lists.debian.org Tue Oct 29 13:18:08 2019 Old-Return-Path: X-Amavis-Spam-Status: No, score=-4.749 tagged_above=-10000 required=5.3 tests=[BAYES_00=-2, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, FREEMAIL_FORGED_FROMDOMAIN=0.001, FREEMAIL_FROM=0.001, HEADER_FROM_DIFFERENT_DOMAINS=0.249, HTML_MESSAGE=2, LDO_WHITELIST=-5, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=no autolearn_force=no X-Policyd-Weight: using cached result; rate: -5.5 Dkim-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ondrej-org.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=If+fc0o7o6E1UOpRaynZA7hOUB/peLh8/uAYEYe4Gyc=; b=w6Z1Jlwq6FjqmyhXlmjL/6ce/WINLvXuP132HjxJ974zgbn6DSTVc3bOiv6AuTalBA yx/IEstHuZHGmci/u3+9FJRLOOE6A8qrDcNspKQqHNoln0q60OhrkjspeXlcTcBeYAgR F63gKLpzp6IUlo99dT8jjyrIFGtxLxSlp6b0IYvNs5i8EsujCZu674RGWQ50d8HkWxn+ F9vMIj8palCoOZzEmyOTOh8RwfqxS4ridmXm3xcOjW2FhYOan0ZBoQC1tgxsyVEeVTct SghlkhzTSaXdAH3soea1u78pmvLZSyOwEdCTR1PgdTsh0kGVKWC6vuJltieMgfKXC2oD GD0A== X-Google-Dkim-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=If+fc0o7o6E1UOpRaynZA7hOUB/peLh8/uAYEYe4Gyc=; b=lhTyV+99umuBKGiojp7Nf1cjywvYXJXgQ+FFcPDpsf6zrux7gqJG1TvxRLtfVKfgJ0 kWgeJpCBhPQE0AXkAS9Nj3DLYiCjmJshFXcQSPDPmp3sZAtWXyXLyALv3b0sPXddb9D2 PmKI0PfNabYX39LYiXHHkOkDy5aHnFrbWzZ9POSznh8KkNaHya5b//DjeHCuWX7Rn/9u Og4t9LL9nyQ1qK6MKAN+UvR7h9NclDcJEihob9T0TfmV2rP+kijvh0gDdDQAGaDkhoeI HgeJHlmHGc1eCSdD/3a7Fps5CqEvcWmN7Hhs7VambmI9cAZurT9gfHg7JGaBEaxM4b4k Id9A== X-Gm-Message-State: APjAAAUAo+7uWlKPPH2slXhUZkUdQot6Uqv9Fmb04GSekZUhI+UlpC7a 0e5AYzpMrOYzPb3rwSZ4ZRNJY8GWz0N52JdMzXtfeckX X-Google-SMTP-Source: APXvYqzOr1pu+QFHYSoz0STXaX3MiXgituLy+qEAVEU0zRrc0tdlPtbWMm4Q9ygF75TttoYQx4HdLstLNwxUbje2lGo= X-Received: by 2002:a05:6102:80f:: with SMTP id g15mr629585vsb.229.1572354101413; Tue, 29 Oct 2019 06:01:41 -0700 (PDT) MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="000000000000ad0fdc05960c37fa" X-Mailing-List: archive/latest/17526 List-ID: List-URL: List-Archive: https://lists.debian.org/msgid-search/CAOO6c=wnXQLUFJKwj3pyATR2-zUM0EJz6zzFFrX1qxnOXg1RPg@mail.gmail.com Approved: robomod@news.nic.it Lines: 53 Organization: linux.* mail to news gateway Sender: robomod@news.nic.it X-Original-Cc: debian-python X-Original-Date: Tue, 29 Oct 2019 14:01:29 +0100 X-Original-Message-ID: X-Original-References: <20191027151300.wxpij5kweuy6uw6i@mornie> <6c89d2c7a0e830e0656210f395a8426d@debian.org> Xref: csiph.com linux.debian.maint.python:11965 --000000000000ad0fdc05960c37fa Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi, =C3=BAt 29. 10. 2019 v 13:29 odes=C3=ADlatel Michael Kesper napsal: > > I see. Still an odd kind of protection though. The attacker can just > downgrade themselves. > > No. A sensible server will not talk to you if your requested SSL version > is too low. > pub.orcid.org seems to use absolutely outdated and insecure software > versions. > right. If you want good security, you need to limit TLS version on both side (client-urlib3 and server-whatever). Than downgrade attack is not possible. --=20 Best regards Ond=C5=99ej Nov=C3=BD --000000000000ad0fdc05960c37fa Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi,

=C3=BAt 29. 10. 2019 v=C2=A013:29 odes=C3=ADlatel = Michael Kesper <mkesper@schoko= keks.org> napsal:
> I see. Still an odd kind of protection though.=C2=A0 The at= tacker can just downgrade themselves.

No. A sensible server will not talk to you if your requested SSL version is= too low.
pub.o= rcid.org seems to use absolutely outdated and insecure software version= s.

right. If you want good security, yo= u need to limit TLS version on both side (client-urlib3 and server-whatever= ). Than downgrade attack is not possible.=C2=A0

-= -
Best regards
=C2=A0= Ond=C5=99ej Nov=C3=BD

--000000000000ad0fdc05960c37fa--