[3.5] bpo-41004: Resolve hash collisions for IPv4Interface and IPv6In… #21233
Conversation
|
Sorry, we only accept the security patch for 3.5-3.7. I close this PR cc @ericvsmith |
corona10
left a comment
corona10
left a comment
There was a problem hiding this comment.
Since this issue is reported as the CVE-2020-14422.
I am okay to merge this PR as the security issue.
But waiting for @ned-deily and @ericvsmith 's comment :)
|
The decision whether to merge to 3.5 is up to the 3.5 release manager, @larryhastings. |
|
As I noted on the bpo issue, I think the NEWS blurb should be updated to include the CVE. |
…terface (pythonGH-21033) The __hash__() methods of classes IPv4Interface and IPv6Interface had issue of generating constant hash values of 32 and 128 respectively causing hash collisions. The fix uses the hash() function to generate hash values for the objects instead of XOR operation (cherry picked from commit b30ee26) Co-authored-by: Ravi Teja P <[email protected]> Signed-off-by: Tapas Kundu <[email protected]>
|
@larryhastings Please help to review the backport to 3.5 of a security fix. Thanks! |
|
@larryhastings: Please replace |
|
Thanks for the backport! And, for the record, @ericvsmith is a great guy, but he is not nor has ever been a Python release manager. |
|
7 participants
…terface (GH-21033)
The hash() methods of classes IPv4Interface and IPv6Interface had issue
of generating constant hash values of 32 and 128 respectively causing hash collisions.
The fix uses the hash() function to generate hash values for the objects
instead of XOR operation
(cherry picked from commit b30ee26)
Co-authored-by: Ravi Teja P [email protected]
Signed-off-by: Tapas Kundu [email protected]
https://bugs.python.org/issue41004