[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAKG8Do524=Adj62mrRP0eZb0bp7CbXN3yi_Mid5VxFvdE1sE=A@mail.gmail.com>
Date: Wed, 15 Jun 2016 10:42:48 +0200
From: Cedric Buissart <cbuissar@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request: Python HTTP header injection in urrlib2/urllib/httplib/http.client
Hi Tim,
On Tue, Jun 14, 2016 at 11:16 PM, Tim <tim-security@...tinelchicken.org>
wrote:
>
> In the mean time, do you happen to have specific information on which
> versions of the 2.x and 3.x upstream branches were affected/fixed?
>
Reproducible on all python versions I tested : 2.4, 2.6, 2.7, 3.4 and 3.5
Fixed branches :
3.4 / 3.5 : revision 94952 : https://hg.python.org/cpython/rev/bf3e1c9b80e9
2.7 : revision 94951 : https://hg.python.org/cpython/rev/1c45047c5102
Regards,
--
Cedric Buissart,
Product Security
Purkynova 99
Brno 612 45
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
