Comment by di | Hacker News Reader

Top New Best Ask Show Jobs

Comment by di | Hacker News Reader

Parent Full thread

di·

Already fixed in Python 3.6, 3.7, 3.8 and 3.9: https://bugs.python.org/issue42938

3.6.13 and 3.7.10 have already been released with the fix: https://www.python.org/downloads/release/python-3613/ https://www.python.org/downloads/release/python-3710/

The 3.8.8 and 3.9.2 release candidates with the fix will be promoted on Monday March 1st: https://discuss.python.org/t/python-3-9-2rc1-and-3-8-8rc1-ar...

If you're on 3.5 or lower, these versions are no longer receiving security fixes and will not be patched: https://python-release-cycle.glitch.me/

Surely delaying an RCE fix for two weeks on supported versions of Python is a mistake.

Distros are backporting security patches into their releases, so no harm done. If you rely on the python.org releases and don't build from source, then yes, that is a bit sad.

Case in point: The Debian security tracker, see their notes section referencing each commit.

https://security-tracker.debian.org/tracker/CVE-2021-3177

The python:3.8 and python:3.9 container images if used to build web services such as Django with GIS extensions may have an RCE until Python.org sources are updated.

Why can't the base image receive those patches as well?

Those images pull from python.org sources, see:

https://github.com/docker-library/python/blob/master/3.8/bus...

The release candidates are already available to use if you don't want to wait 2 weeks.

Update: 3.8.8 and 3.9.2 have been released. https://discuss.python.org/t/python-3-9-2-and-3-8-8-are-now-...

Reply on news.ycombinator.com