-
-
Notifications
You must be signed in to change notification settings - Fork 31.5k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Update binary builds to use zlib 1.2.13 #98689
Labels
3.10
only security fixes
3.11
only security fixes
3.12
only security fixes
OS-windows
release-blocker
type-bug
An unexpected behavior, bug, or error
type-security
A security issue
Comments
zware
added a commit
to python/cpython-source-deps
that referenced
this issue
Nov 1, 2022
zware
added a commit
to zware/cpython
that referenced
this issue
Nov 1, 2022
zware
added a commit
that referenced
this issue
Nov 1, 2022
miss-islington
pushed a commit
to miss-islington/cpython
that referenced
this issue
Nov 1, 2022
(cherry picked from commit c085974) Co-authored-by: Zachary Ware <[email protected]>
miss-islington
pushed a commit
to miss-islington/cpython
that referenced
this issue
Nov 1, 2022
(cherry picked from commit c085974) Co-authored-by: Zachary Ware <[email protected]>
Since we no longer distribute binaries for 3.9 or before (and aren't actually vulnerable anyway), I don't think we should backport further than 3.10. |
miss-islington
added a commit
that referenced
this issue
Nov 1, 2022
(cherry picked from commit c085974) Co-authored-by: Zachary Ware <[email protected]>
miss-islington
added a commit
that referenced
this issue
Nov 1, 2022
(cherry picked from commit c085974) Co-authored-by: Zachary Ware <[email protected]>
Repository owner
moved this from Todo
to Done
in Release and Deferred blockers 🚫
Nov 1, 2022
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Labels
3.10
only security fixes
3.11
only security fixes
3.12
only security fixes
OS-windows
release-blocker
type-bug
An unexpected behavior, bug, or error
type-security
A security issue
A new version of zlib is out: 1.2.13 - https://zlib.net/
zlib 1.2.12 has CVE-2022-37434:
https://www.openwall.com/lists/oss-security/2022/08/09/1
but... we do not appear to call the vulnerable
inflateGetHeader
API. So this is more of a thing we just need to do before the next round of binary builds rather than an urgent new windows binary release update as 1.2.12 was.Maybe this doesn't deserve the type-security label, but so long as our binary builds link with 1.2.12 people will ask us about that CVE.
The text was updated successfully, but these errors were encountered: