Repository navigation
Upgrade to zlib v1.2.12 in CPython binary releases #91350
Description
Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.
Show more details
GitHub fields:
assignee = None
closed_at = None
created_at = <Date 2022-04-01.19:25:42.678>
labels = ['3.8', '3.9', 'release-blocker', 'extension-modules', '3.7', 'type-security', '3.10', '3.11', 'OS-windows']
title = 'Upgrade to zlib v1.2.12 in CPython binary releases'
updated_at = <Date 2022-04-04.03:27:26.636>
user = 'https://github.com/gpshead'bugs.python.org fields:
activity = <Date 2022-04-04.03:27:26.636>
actor = 'ned.deily'
assignee = 'none'
closed = False
closed_date = None
closer = None
components = ['Extension Modules', 'Windows']
creation = <Date 2022-04-01.19:25:42.678>
creator = 'gregory.p.smith'
dependencies = []
files = []
hgrepos = []
issue_num = 47194
keywords = ['patch']
message_count = 5.0
messages = ['416510', '416552', '416555', '416556', '416651']
nosy_count = 9.0
nosy_names = ['gregory.p.smith', 'paul.moore', 'tim.golden', 'ned.deily', 'lukasz.langa', 'zach.ware', 'steve.dower', 'pablogsal', 'miss-islington']
pr_nums = ['32241', '32248', '32249', '32250', '32251']
priority = 'release blocker'
resolution = None
stage = 'patch review'
status = 'open'
superseder = None
type = 'security'
url = 'https://bugs.python.org/issue47194'
versions = ['Python 3.7', 'Python 3.8', 'Python 3.9', 'Python 3.10', 'Python 3.11']
Activity
gpshead commentedon Apr 1, 2022
zlib v1.2.11 as used in Windows binary releases contains a security issue that, while fixed in its git repo years ago, never wound up in a release or a CVE until just now.
Folllow the https://www.openwall.com/lists/oss-security/2022/03/24/1 thread and the and recently assigned CVE-2018-25032.
I believe we only ship our own zlib on Windows so this issue is tagged as such. The above oss-security thread is where an idea of severity will come out.
6 remaining items
miss-islington commentedon Apr 2, 2022
New changeset 16a809f by Miss Islington (bot) in branch '3.10':
bpo-47194: Update zlib to v1.2.12 on Windows to resolve CVE-2018-25032 (GH-32241)
16a809f
ned-deily commentedon Apr 4, 2022
New changeset 387f93c by Miss Islington (bot) in branch '3.7':
bpo-47194: Update zlib to v1.2.12 on Windows to resolve CVE-2018-25032 (GH-32241) (GH-32251)
387f93c
pablogsal commentedon May 6, 2022
Is there anything left to do in this issue? Can we close it?
vstinner commentedon May 6, 2022
It seems like zlib is still outdated in Python 3.8.
I have a tool to check for "external libraries versions": https://github.com/vstinner/misc/blob/main/cpython/external_versions.py
vstinner commentedon May 6, 2022
There is #32250 but the Docs CI failed. I removed/added back the "backport to 3.8" label on #32241 and it updated the 3.8 PR.
gpshead commentedon May 6, 2022
yep just waiting on that 3.8 PR being merged by its RM. we don't have a good way to indicate which branches an issue remains a release-blocker for.
zware commentedon May 16, 2022
With the merge of #32250, this is now resolved in all active branches. Does anyone have a handle on whether the severity of the CVE is high enough to warrant releases?
ambv commentedon May 16, 2022
Since we only ship our own zlib with installers and 3.7-3.8 aren't shipping installers anymore, I don't think we need a security release for that. The only other change in 3.8 is a sqlite segfault fix so I think I'll pass on releasing a 3.8 at this time.
ned-deily commentedon May 20, 2022
Likewise with 3.7 so time to close this. Thanks, everyone!