Register | Log in

python3.5

Choose email to subscribe with

general

source: python3.5 (updates)
version: 3.5.3-1+deb9u1
maintainer: Matthias Klose (DMD)
arch: all any
std-ver: 3.9.8
VCS: Bazaar (Browse)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

stable: 3.5.3-1+deb9u1
stable-sec: 3.5.3-1+deb9u1

versioned links

3.5.3-1+deb9u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

idle-python3.5
libpython3.5
libpython3.5-dbg
libpython3.5-dev
libpython3.5-minimal (1 bugs: 0, 1, 0, 0)
libpython3.5-stdlib
libpython3.5-testsuite
python3.5
python3.5-dbg
python3.5-dev
python3.5-doc
python3.5-examples
python3.5-minimal
python3.5-venv

package is gone

This package is not in any development repository. This probably means that the package has been removed (or has been renamed). Thus the information here is of little interest ... the package is going to disappear unless someone takes it over and reintroduces it.

action needed

9 security issues in stretch high

There are 9 open security issues in stretch.

7 important issues:

CVE-2019-9947: An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the path component of a URL that lacks a ? character) followed by an HTTP header or a Redis command. This is similar to the CVE-2019-9740 query string issue.
CVE-2019-9948: urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call.
CVE-2019-9740: An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the query string after a ? character) followed by an HTTP header or a Redis command.
CVE-2018-20852: http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain: it can be tricked into sending existing cookies to the wrong server. An attacker may abuse this flaw by using a server with a hostname that has another valid hostname as a suffix (e.g., pythonicexample.com to steal cookies for example.com). When a program uses http.cookiejar.DefaultPolicy and tries to do an HTTP connection to an attacker-controlled server, existing cookies can be leaked to the attacker. This affects 2.x through 2.7.16, 3.x before 3.4.10, 3.5.x before 3.5.7, 3.6.x before 3.6.9, and 3.7.x before 3.7.3.
CVE-2019-9636: Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cached against a given hostname). The components are: urllib.parse.urlsplit, urllib.parse.urlparse. The attack vector is: A specially crafted URL could be incorrectly parsed to locate cookies or authentication data and send that information to a different host than when parsed correctly.
CVE-2019-16935: The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the server_title field. This occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in Lib/xmlrpc/server.py in Python 3.x. If set_server_title is called with untrusted input, arbitrary JavaScript can be delivered to clients that visit the http URL for this server.
CVE-2019-16056: An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To headers of a message could be tricked into accepting an email address that should be denied. An attack may be the same as in CVE-2019-11340; however, this CVE applies to Python more generally.

2 issues skipped by the security teams:

CVE-2019-5010: An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attacker can initiate or accept TLS connections using crafted certificates to trigger this vulnerability.
CVE-2020-8492: Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking.

Please fix them.

Created: 2018-12-25 Last update: 2020-02-13 12:35

news

[2018-10-31] Removed 3.5.6-1 from unstable (Debian FTP Masters)
[2018-10-02] Accepted python3.5 3.5.3-1+deb9u1 (source all amd64) into proposed-updates->stable-new, proposed-updates (Moritz Mühlenhoff)
[2018-09-28] Accepted python3.5 3.5.3-1+deb9u1 (source all amd64) into stable->embargoed, stable (Moritz Mühlenhoff)
[2018-08-03] Accepted python3.5 3.5.6-1 (source) into unstable (Matthias Klose)
[2018-03-13] Accepted python3.5 3.5.5-1 (source) into unstable (Matthias Klose)
[2017-12-06] python3.5 REMOVED from testing (Debian testing watch)
[2017-10-28] python3.5 3.5.4-4 MIGRATED to testing (Debian testing watch)
[2017-10-27] python3.5 3.5.4-4 MIGRATED to testing (Debian testing watch)
[2017-09-05] Accepted python3.5 3.5.4-4 (source) into unstable (Matthias Klose)
[2017-08-31] Accepted python3.5 3.5.4-3 (source) into unstable (Matthias Klose)
[2017-08-18] python3.5 3.5.4-2 MIGRATED to testing (Debian testing watch)
[2017-08-12] Accepted python3.5 3.5.4-2 (source) into unstable (Matthias Klose)
[2017-08-08] Accepted python3.5 3.5.4-1 (source) into unstable (Matthias Klose)
[2017-07-31] python3.5 3.5.4~rc1-1 MIGRATED to testing (Debian testing watch)
[2017-07-25] Accepted python3.5 3.5.4~rc1-1 (source) into unstable (Matthias Klose)
[2017-06-20] python3.5 3.5.3-3 MIGRATED to testing (Debian testing watch)
[2017-06-08] Accepted python3.5 3.5.3-3 (source) into unstable (Matthias Klose)
[2017-06-07] Accepted python3.5 3.5.3-2 (source) into unstable (Matthias Klose)
[2017-01-30] python3.5 3.5.3-1 MIGRATED to testing (Debian testing watch)
[2017-01-19] Accepted python3.5 3.5.3-1 (source) into unstable (Matthias Klose)
[2017-01-13] python3.5 3.5.3~rc1-1 MIGRATED to testing (Debian testing watch)
[2017-01-03] Accepted python3.5 3.5.3~rc1-1 (source) into unstable (Matthias Klose)
[2016-12-24] python3.5 3.5.2-9 MIGRATED to testing (Debian testing watch)
[2016-12-13] Accepted python3.5 3.5.2-9 (source) into unstable (Matthias Klose)
[2016-11-28] python3.5 3.5.2-8 MIGRATED to testing (Debian testing watch)
[2016-11-22] Accepted python3.5 3.5.2-8 (source) into unstable (Matthias Klose)
[2016-11-03] Accepted python3.5 3.5.2-7 (source) into unstable (Matthias Klose)
[2016-09-28] python3.5 3.5.2-6 MIGRATED to testing (Debian testing watch)
[2016-09-22] Accepted python3.5 3.5.2-6 (source) into unstable (Matthias Klose)
[2016-09-16] python3.5 3.5.2-5 MIGRATED to testing (Debian testing watch)

1
2

bugs [bug history graph]

all: 2
RC: 0
I&N: 2
M&W: 0
F&P: 0
patch: 0

links

buildd: logs, clang, cross
popcon
browse source code
edit tags
security tracker
screenshots

Debian Package Tracker — Copyright 2013-2018 The Distro Tracker Developers

Report problems to the tracker.debian.org pseudo-package in the Debian BTS.

Documentation — Bugs — Git Repository — Contributing