FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

[3.5] bpo-41004: Resolve hash collisions for IPv4Interface and IPv6In… by tapakund · Pull Request #21233 · python/cpython · GitHub

  1. python
  2. cpython

Repository navigation

[3.5] bpo-41004: Resolve hash collisions for IPv4Interface and IPv6In… - #21233

Merged
larryhastings merged 3 commits into
python:3.5from
tapakund:3.5
Aug 4, 2020
ConversationCommits (3)ChecksFiles changed
Merged

[3.5] bpo-41004: Resolve hash collisions for IPv4Interface and IPv6In…#21233
larryhastings merged 3 commits into
python:3.5from
tapakund:3.5

Conversation

tapakund commented Jun 30, 2020 •
edited by bedevere-bot
Loading

Copy link
Copy Markdown

…terface (GH-21033)

The hash() methods of classes IPv4Interface and IPv6Interface had issue
of generating constant hash values of 32 and 128 respectively causing hash collisions.
The fix uses the hash() function to generate hash values for the objects
instead of XOR operation
(cherry picked from commit b30ee26)

Co-authored-by: Ravi Teja P rvteja92@gmail.com

Signed-off-by: Tapas Kundu tkundu@vmware.com

https://bugs.python.org/issue41004

corona10 commented Jun 30, 2020

Copy link
Copy Markdown
Member

Sorry, we only accept the security patch for 3.5-3.7.

I close this PR cc @ericvsmith

ref: https://devguide.python.org/#status-of-python-branches

corona10 closed this Jun 30, 2020
corona10 reopened this Jun 30, 2020
corona10 approved these changes Jun 30, 2020
View reviewed changes

corona10 left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

Since this issue is reported as the CVE-2020-14422.
I am okay to merge this PR as the security issue.

But waiting for @ned-deily and @ericvsmith 's comment :)

corona10 requested review from ericvsmith and ned-deily June 30, 2020 11:09
corona10 added the type-security A security issue label Jun 30, 2020

ned-deily commented Jun 30, 2020

Copy link
Copy Markdown
Member

The decision whether to merge to 3.5 is up to the 3.5 release manager, @larryhastings.

ned-deily commented Jun 30, 2020

Copy link
Copy Markdown
Member

As I noted on the bpo issue, I think the NEWS blurb should be updated to include the CVE.

[3.5] bpo-41004: Resolve hash collisions for IPv4Interface and IPv6In…
3e632dc 
…terface (pythonGH-21033)

The __hash__() methods of classes IPv4Interface and IPv6Interface had issue
of generating constant hash values of 32 and 128 respectively causing hash collisions.
The fix uses the hash() function to generate hash values for the objects
instead of XOR operation
(cherry picked from commit b30ee26)

Co-authored-by: Ravi Teja P <rvteja92@gmail.com>

Signed-off-by: Tapas Kundu <tkundu@vmware.com>
ned-deily requested review from larryhastings and removed request for ned-deily June 30, 2020 15:01

tapakund commented Jul 2, 2020

Copy link
Copy Markdown
Author

@larryhastings Please help to review the backport to 3.5 of a security fix. Thanks!

larryhastings merged commit 11d258c into python:3.5 Aug 4, 2020

bedevere-bot commented Aug 4, 2020

Copy link
Copy Markdown

@larryhastings: Please replace # with GH- in the commit message next time. Thanks!

larryhastings commented Aug 4, 2020

Copy link
Copy Markdown
Contributor

Thanks for the backport! And, for the record, @ericvsmith is a great guy, but he is not nor has ever been a Python release manager.

HanaMahmoud122 commented Jan 7, 2024

Copy link
Copy Markdown

print(‘Hello my friend’)

This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

corona10 corona10 approved these changes
ericvsmith Awaiting requested review from ericvsmith
larryhastings Awaiting requested review from larryhastings

Assignees

No one assigned

Labels

type-security A security issue

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

7 participants

Back | FazBrowse Home | New Git URL