delta/cpython-git.git, branch v3.6.12 github.com: python/cpython.git 3.6.12 2020-08-15T06:43:26+00:00 Ned Deily nad@python.org 2020-08-15T06:43:26+00:00 c0a9afe2ac1820409e6173bd1893ebee2cf50270 






bpo-39603: Prevent header injection in http methods (GH-18485) (GH-21539)
2020-07-19T09:28:45+00:00

Miss Islington (bot)
31488909+miss-islington@users.noreply.github.com

2020-07-19T09:28:45+00:00

f02de961b9f19a5db0ead56305fe0057a78787ae

reject control chars in http method in http.client.putrequest to prevent http header injection
(cherry picked from commit 8ca8a2e8fb068863c1138f07e3098478ef8be12e)

Co-authored-by: AMIR <31338382+amiremohamadi@users.noreply.github.com>




reject control chars in http method in http.client.putrequest to prevent http header injection
(cherry picked from commit 8ca8a2e8fb068863c1138f07e3098478ef8be12e)

Co-authored-by: AMIR <31338382+amiremohamadi@users.noreply.github.com>






bpo-39017: Avoid infinite loop in the tarfile module (GH-21454) (#21485)
2020-07-15T12:36:36+00:00

Miss Islington (bot)
31488909+miss-islington@users.noreply.github.com

2020-07-15T12:36:36+00:00

47a2955589bdb1a114d271496ff803ad73f954b8

Avoid infinite loop when reading specially crafted TAR files using the tarfile module
(CVE-2019-20907).
(cherry picked from commit 5a8d121a1f3ef5ad7c105ee378cc79a3eac0c7d4)

Co-authored-by: Rishi <rishi_devan@mail.com>




Avoid infinite loop when reading specially crafted TAR files using the tarfile module
(CVE-2019-20907).
(cherry picked from commit 5a8d121a1f3ef5ad7c105ee378cc79a3eac0c7d4)

Co-authored-by: Rishi <rishi_devan@mail.com>






bpo-41288: Fix a crash in unpickling invalid NEWOBJ_EX. (GH-21458) (GH-21462)
2020-07-13T18:18:04+00:00

Miss Islington (bot)
31488909+miss-islington@users.noreply.github.com

2020-07-13T18:18:04+00:00

6463cf07fef7a923a743fcaf312150c45fd81b64

Automerge-Triggered-By: @tiran
(cherry picked from commit 4f309abf55f0e6f8950ac13d6ec83c22b8d47bf8)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>




Automerge-Triggered-By: @tiran
(cherry picked from commit 4f309abf55f0e6f8950ac13d6ec83c22b8d47bf8)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>






[3.6] bpo-29778: Ensure python3.dll is loaded from correct locations when Python is embedded (GH-21298) (#21354)
2020-07-06T18:55:43+00:00

Steve Dower
steve.dower@python.org

2020-07-06T18:55:43+00:00

46cbf6148a46883110883488d3e9febbe46ba861

* bpo-29778: Ensure python3.dll is loaded from correct locations when Python is embedded (GH-21298)

* bpo-29778: Ensure python3.dll is loaded from correct locations when Python is embedded.

* Add CVE number

* Updates for 3.6




* bpo-29778: Ensure python3.dll is loaded from correct locations when Python is embedded (GH-21298)

* bpo-29778: Ensure python3.dll is loaded from correct locations when Python is embedded.

* Add CVE number

* Updates for 3.6






[3.6] bpo-41004: Resolve hash collisions for IPv4Interface and IPv6Interface (GH-21033) (GH-21232)
2020-06-30T19:30:22+00:00

Tapas Kundu
39723251+tapakund@users.noreply.github.com

2020-06-30T19:30:22+00:00

cfc7ff8d05f7a949a88b8a8dd506fb5c1c30d3e9

CVE-2020-14422
The __hash__() methods of classes IPv4Interface and IPv6Interface had issue
of generating constant hash values of 32 and 128 respectively causing hash collisions.
The fix uses the hash() function to generate hash values for the objects
instead of XOR operation
(cherry picked from commit b30ee26e366bf509b7538d79bfec6c6d38d53f28)

Co-authored-by: Ravi Teja P <rvteja92@gmail.com>

Signed-off-by: Tapas Kundu <tkundu@vmware.com>




CVE-2020-14422
The __hash__() methods of classes IPv4Interface and IPv6Interface had issue
of generating constant hash values of 32 and 128 respectively causing hash collisions.
The fix uses the hash() function to generate hash values for the objects
instead of XOR operation
(cherry picked from commit b30ee26e366bf509b7538d79bfec6c6d38d53f28)

Co-authored-by: Ravi Teja P <rvteja92@gmail.com>

Signed-off-by: Tapas Kundu <tkundu@vmware.com>






Post release updates
2020-06-27T12:38:30+00:00

Ned Deily
nad@python.org

2020-06-27T12:38:30+00:00

2fce0235883e79419d7f3eb96057052e56fdeade












3.6.11
2020-06-27T09:14:00+00:00

Ned Deily
nad@python.org

2020-06-27T09:14:00+00:00

d56cd4006a1c5e07b0bf69fad9fc8e2fbf6aa855












Post release update
2020-06-18T03:54:25+00:00

Ned Deily
nad@python.org

2020-06-18T03:54:25+00:00

93514bd24447d8dd1579ac838e2d8915a1bbc17f












3.6.11rc1
2020-06-17T10:59:51+00:00

Ned Deily
nad@python.org

2020-06-17T10:59:51+00:00

d384df407ebdbb1ab386597658f1ac78e8803afe