<html><body><div style="font-family: times new roman, new york, times, serif; font-size: 12pt; color: #000000"><div><br></div><div><br></div><hr id="zwchr"><blockquote style="border-left:2px solid #1010FF;margin-left:5px;padding-left:5px;color:#000;font-weight:normal;font-style:normal;text-decoration:none;font-family:Helvetica,Arial,sans-serif;font-size:12pt;"><b>From: </b>"Michael" <aixtools@felt.demon.nl><br><b>To: </b>"Larry Hastings" <larry@hastings.org>, python-dev@python.org<br><b>Sent: </b>Sunday, August 5, 2018 8:57:40 PM<br><b>Subject: </b>Re: [Python-Dev] [python-committers] [RELEASED] Python 3.4.9 and Python 3.5.6 are now available<br><div><br></div><div class="moz-cite-prefix">On 03/08/2018 03:22, Larry Hastings
wrote:<br></div><blockquote cite="mid:26fd54bd-602d-8870-5f5c-094b58a1fb2c@hastings.org"><br><br>
On 08/02/2018 07:17 AM, Victor Stinner wrote:
<br><blockquote>3.4.9 and 3.5.6 have no more known
security vulnerabilities :-)
<br></blockquote><br>
Well, not to be a complete pill, but...
<br><br><a class="moz-txt-link-freetext" href="https://bugs.python.org/issue17180" target="_blank">https://bugs.python.org/issue17180</a><br><a class="moz-txt-link-freetext" href="https://bugs.python.org/issue17239" target="_blank">https://bugs.python.org/issue17239</a><br><a class="moz-txt-link-freetext" href="https://bugs.python.org/issue19050" target="_blank">https://bugs.python.org/issue19050</a><br><br>
Sadly, just because they're languishing on bpo doesn't mean they
aren't valid security vulnerabilities.
<br><br></blockquote>
+1 - Sadly, not fixed after 5 years - Why? Because it isn't sexy, or
fear for breaking things?<br><br>
Breaking things could be valid - when it is a feature/design change,
but the whole point of security fixes is because we believe the
security vulnerability is breakage. Not fixing it keeps everything
that depends on it (intentional or not) also broken. Any app that
depends on 'broken' behavior needs to be fixed - rather than let a
known vulnerability go from 0-day to 1825-day vulnerability (or is
it 2000 already?)<br><br>
Only read the discussion for 17180 - but it seems anything old does
not get fixed because it did not get fixed years ago.<br><br>
my two cents!<br><br>
On a side note: I have been trying to test python on different
"enterprise" distros of linux and am amazed to see Python2-2.7.5 as
the 'standard'. Rather disheartening for the all the good work that
gets done. i.e., I am amazed that CVE's like the ones fixed in 3.4.9
and 3.5.6 (and maybe already/later in 2.7.X) do not motivate
distributions to update to current levels.<br></blockquote><div><br></div><div>A side note on your side note. Different distro's have different standards, use/customer cases to address etc. In enterprise distributions the usual scheme is that the version that you see is the minimum one and many fixes coming from upstream or the redistributor<br></div><div>are incorporated on top of that version. Just check the package changelogs. :) CVE's do get fixed and there is actually cooperation with upstream on different levels in regards to those. And speaking here as one of the people doing that for one of the enterprise<br></div><div>distros.<br></div><div><br></div><blockquote style="border-left:2px solid #1010FF;margin-left:5px;padding-left:5px;color:#000;font-weight:normal;font-style:normal;text-decoration:none;font-family:Helvetica,Arial,sans-serif;font-size:12pt;">
oh my - up to 4 cents! :)<br><br>
Thanks for the work - I'll get to packaging them for AIX.<br><br><blockquote cite="mid:26fd54bd-602d-8870-5f5c-094b58a1fb2c@hastings.org"><br>
//arry/
<br><br><br><br><pre>_______________________________________________
Python-Dev mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Python-Dev@python.org" target="_blank">Python-Dev@python.org</a><a class="moz-txt-link-freetext" href="https://mail.python.org/mailman/listinfo/python-dev" target="_blank">https://mail.python.org/mailman/listinfo/python-dev</a>
Unsubscribe: <a class="moz-txt-link-freetext" href="https://mail.python.org/mailman/options/python-dev/aixtools%40felt.demon.nl" target="_blank">https://mail.python.org/mailman/options/python-dev/aixtools%40felt.demon.nl</a></pre></blockquote><p><br></p><br>_______________________________________________<br>Python-Dev mailing list<br>Python-Dev@python.org<br>https://mail.python.org/mailman/listinfo/python-dev<br>Unsubscribe: https://mail.python.org/mailman/options/python-dev/cstratak%40redhat.com<br></blockquote><div><br><br></div><div><br></div><div>-- <br></div><div><span name="x"></span>Regards,<br><div><br></div>Charalampos Stratakis<br>Software Engineer<br>Python Maintenance Team, Red Hat<span name="x"></span><br></div></div></body></html>