<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#330033">
On 1/5/2012 11:49 AM, Tres Seaver wrote:
<blockquote cite="mid:je4ut2$9fv$1@dough.gmane.org" type="cite">
<pre wrap="">-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 01/05/2012 02:14 PM, Glenn Linderman wrote:
</pre>
<blockquote type="cite">
<pre wrap="">1) the security problem is not in CPython, but rather in web servers
that use dict inappropriately.
</pre>
</blockquote>
<pre wrap="">
Most webapp vulnerabilities are due to their use of Python's cgi module,
which it uses a dict to hold the form / query string data being supplied
by untrusted external users.
</pre>
</blockquote>
<br>
Yes, I understand that (and have some such web apps in production).<br>
<br>
In fact, I pointed out urllib.parse and cgi as specific modules for
which a proposed fix could be made without impacting the Python hash
function.<br>
</body>
</html>