◐ Shell
reader mode source ↗
Skip to content

[3.5] closes bpo-38576: Disallow control characters in hostnames in h…#19300

Merged
larryhastings merged 4 commits into
python:3.5from
tapakund:bpo-38576
Jun 20, 2020
Merged

[3.5] closes bpo-38576: Disallow control characters in hostnames in h…#19300
larryhastings merged 4 commits into
python:3.5from
tapakund:bpo-38576

Conversation

@tapakund

@tapakund tapakund commented Apr 2, 2020 •
edited by bedevere-bot
Loading

Copy link
Copy Markdown

…ttp.client.

Add host validation for control characters for more
CVE-2019-18348 protection.
(cherry picked from commit 83fc701)

Co-authored-by: Ashwin Ramaswami aramaswamis@gmail.com

Signed-off-by: Tapas Kundu tkundu@vmware.com

https://bugs.python.org/issue38576

@tapakund
[3.5] closes bpo-38576: Disallow control characters in hostnames in h… …
601af8e 
…ttp.client.

Add host validation for control characters for more
CVE-2019-18348 protection.
(cherry picked from commit 83fc701)

Co-authored-by: Ashwin Ramaswami <aramaswamis@gmail.com>

Signed-off-by: Tapas Kundu <tkundu@vmware.com>
@tapakund tapakund mentioned this pull request Apr 2, 2020
Closed
@tapakund

tapakund commented Apr 2, 2020

Copy link
Copy Markdown
Author

This is same as #19231 @epicfaace @gpshead pls review.

@tapakund

tapakund commented Jun 5, 2020

Copy link
Copy Markdown
Author

Ping @larryhastings : Please help to review the backport to 3.5 of a security fix. Thanks!

@tapakund

tapakund commented Jun 18, 2020

Copy link
Copy Markdown
Author

@larryhastings the build status isn't clear. I would need help fixing it(if a fix is needed).

@larryhastings

larryhastings commented Jun 20, 2020

Copy link
Copy Markdown
Contributor

There's some sort of ongoing communication problem between Travis CI and Github. It doesn't happen frequently, so if you just re-run the Travis CI check it'll usually work fine the second time. By merging a different PR, that caused this PR to be out-of-date, and updating it meant I could run Travis CI again, and now everything is fine.

@larryhastings larryhastings merged commit 09d8172 into python:3.5 Jun 20, 2020
@bedevere-bot

bedevere-bot commented Jun 20, 2020

Copy link
Copy Markdown

@larryhastings: Please replace # with GH- in the commit message next time. Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer

@epicfaace epicfaace epicfaace approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

@larryhastings larryhastings

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@tapakund @larryhastings @bedevere-bot @epicfaace @the-knights-who-say-ni