[ubuntu/xenial-security] python3.5 3.5.2-2ubuntu0~16.04.1 (Accepted)

[Steve Beattie]

python3.5 (3.5.2-2ubuntu0~16.04.1) xenial-security; urgency=medium

  * SECURITY UPDATE: use of HTTP_PROXY flag supplied by attacker in CGI
    scripts (aka HTTPOXY attack)
    - debian/patches/CVE-2016-1000110.patch: if running as CGI
      script, forget HTTP_PROXY in Lib/urllib.py, add test to
      Lib/test/test_urllib.py, add documentation.
    - CVE-2016-1000110
  * NOTE: backport of 3.5.2 to Ubuntu 16.04 LTS also addresses:
    - CVE-2016-0772: StartTLS stripping attack
    - CVE-2016-5636: Integer overflow when handling zipfiles

Date: 2016-11-17 18:39:17.355593+00:00
Changed-By: Steve Beattie <sbeattie at ubuntu.com>
https://launchpad.net/ubuntu/+source/python3.5/3.5.2-2ubuntu0~16.04.1
-------------- next part --------------
Sorry, changesfile not available.