delta/cpython-git.git, branch 3.5 github.com: python/cpython.git Post-release update for 3.5.10. 2020-09-05T09:04:10+00:00 Larry Hastings larry@hastings.org 2020-09-05T09:04:10+00:00 75c1ca7b6c546ef674eb40bfe47f41e6045dc99b 






Version bump for 3.5.10.
2020-09-05T07:22:07+00:00

Larry Hastings
larry@hastings.org

2020-09-05T07:22:07+00:00

426b022776672fdf3d71ddd98d89af341c88080f












Blurb release and pydoc topics for 3.5.10.
2020-09-05T07:21:11+00:00

Larry Hastings
larry@hastings.org

2020-09-05T07:21:11+00:00

f2f17bd54c0121d4a6f6fd88c64c963e9b3b0ba1












bpo-39603: Prevent header injection in http methods (GH-18485) (#21946)
2020-09-04T00:54:15+00:00

Victor Stinner
vstinner@python.org

2020-09-04T00:54:15+00:00

524b8de630036a29ca340bc2ae6fd6dc7dda8f40

reject control chars in http method in http.client.putrequest to prevent http header injection

(cherry picked from commit 8ca8a2e8fb068863c1138f07e3098478ef8be12e)

Co-authored-by: AMIR <31338382+amiremohamadi@users.noreply.github.com>




reject control chars in http method in http.client.putrequest to prevent http header injection

(cherry picked from commit 8ca8a2e8fb068863c1138f07e3098478ef8be12e)

Co-authored-by: AMIR <31338382+amiremohamadi@users.noreply.github.com>






Post-release update for 3.5.10rc1.
2020-08-22T02:56:06+00:00

Larry Hastings
larry@hastings.org

2020-08-22T02:56:06+00:00

6c065594c720fdd4783a4284cb9f2eebcb2c10bd












Version bump and copyright update for 3.5.10rc1.
2020-08-19T19:56:53+00:00

Larry Hastings
larry@hastings.org

2020-08-19T19:56:53+00:00

e53c98563824cbb2f296f1de1f2185a7b5271cd6












Blurb release and pydoc topics for 3.5.10rc1.
2020-08-19T19:51:35+00:00

Larry Hastings
larry@hastings.org

2020-08-19T19:51:35+00:00

45efe034e66973c8702b8bbbcac041c873aa5da3












[3.5] bpo-41004: Resolve hash collisions for IPv4Interface and IPv6Interface (GH-21033) (#21233)
2020-08-04T02:33:30+00:00

Tapas Kundu
39723251+tapakund@users.noreply.github.com

2020-08-04T02:33:30+00:00

11d258ceafdf60ab3840f9a5700f2d0ad3e2e2d1

CVE-2020-14422: The __hash__() methods of classes IPv4Interface and IPv6Interface had issue
of generating constant hash values of 32 and 128 respectively causing hash collisions.
The fix uses the hash() function to generate hash values for the objects
instead of XOR operation.

(cherry picked from commit b30ee26e366bf509b7538d79bfec6c6d38d53f28)

Co-authored-by: Ravi Teja P <rvteja92@gmail.com>

Signed-off-by: Tapas Kundu <tkundu@vmware.com>




CVE-2020-14422: The __hash__() methods of classes IPv4Interface and IPv6Interface had issue
of generating constant hash values of 32 and 128 respectively causing hash collisions.
The fix uses the hash() function to generate hash values for the objects
instead of XOR operation.

(cherry picked from commit b30ee26e366bf509b7538d79bfec6c6d38d53f28)

Co-authored-by: Ravi Teja P <rvteja92@gmail.com>

Signed-off-by: Tapas Kundu <tkundu@vmware.com>






[3.5] bpo-29778: Ensure python3.dll is loaded from correct locations when Python is embedded (GH-21297) (#21377)
2020-08-04T02:16:20+00:00

Steve Dower
steve.dower@python.org

2020-08-04T02:16:20+00:00

f205f1000a2d7f8b044caf281041b3705f293480

bpo-29778: Ensure python3.dll is loaded from correct locations when Python is embedded.




bpo-29778: Ensure python3.dll is loaded from correct locations when Python is embedded.






[3.5] bpo-39017: Avoid infinite loop in the tarfile module (GH-21454) (#21489)
2020-07-16T19:48:01+00:00

Petr Viktorin
encukou@gmail.com

2020-07-16T19:48:01+00:00

cac9ca8ed99bd98f4c0dcd1913a146192bf5ee84

Avoid infinite loop when reading specially crafted TAR files using the tarfile module
(CVE-2019-20907).
(cherry picked from commit 5a8d121a1f3ef5ad7c105ee378cc79a3eac0c7d4)

Co-authored-by: Rishi <rishi_devan@mail.com>




Avoid infinite loop when reading specially crafted TAR files using the tarfile module
(CVE-2019-20907).
(cherry picked from commit 5a8d121a1f3ef5ad7c105ee378cc79a3eac0c7d4)

Co-authored-by: Rishi <rishi_devan@mail.com>