Skip to content

[3.6] bpo-41004: Resolve hash collisions for IPv4Interface and IPv6In… #21232

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Jun 30, 2020
Merged

[3.6] bpo-41004: Resolve hash collisions for IPv4Interface and IPv6In… #21232

merged 1 commit into from
Jun 30, 2020

Conversation

tapakund
Copy link

@tapakund tapakund commented Jun 30, 2020 •
edited by bedevere-bot
Loading

…terface (GH-21033)

The hash() methods of classes IPv4Interface and IPv6Interface had issue
of generating constant hash values of 32 and 128 respectively causing hash collisions.
The fix uses the hash() function to generate hash values for the objects
instead of XOR operation
(cherry picked from commit b30ee26)

Co-authored-by: Ravi Teja P rvteja92@gmail.com

Signed-off-by: Tapas Kundu tkundu@vmware.com

https://bugs.python.org/issue41004

@corona10
Copy link
Member

Sorry, we only accept the security patch for 3.5-3.7.

I close this PR cc @ericvsmith

ref: https://devguide.python.org/#status-of-python-branches

@corona10 corona10 closed this Jun 30, 2020
@tapakund
Copy link
Author

@corona10 this is assigned a CVE-2020-14422

Pls refer: https://nvd.nist.gov/vuln/detail?vulnId=CVE-2020-14422

Let me know if i am wrong.

@corona10
Copy link
Member

@tapakund
Thanks for let me know in this case, we should re-open the PR and the issue :)

@corona10 corona10 reopened this Jun 30, 2020
@corona10 corona10 requested review from ericvsmith and ned-deily June 30, 2020 11:06
corona10
corona10 approved these changes Jun 30, 2020
View reviewed changes
Copy link
Member

@corona10 corona10 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since this issue is reported as the CVE-2020-14422.
I am okay to merge this PR as the security issue.

But waiting @ned-deily and @ericvsmith 's comment :)

@corona10 corona10 added the type-security A security issue label Jun 30, 2020
@ned-deily
Copy link
Member

As I commented on the bpo issue, please add the CVE to the NEWS item.

@tapakund
[3.6] bpo-41004: Resolve hash collisions for IPv4Interface and IPv6In…
a08197f 
…terface (pythonGH-21033)

The __hash__() methods of classes IPv4Interface and IPv6Interface had issue
of generating constant hash values of 32 and 128 respectively causing hash collisions.
The fix uses the hash() function to generate hash values for the objects
instead of XOR operation
(cherry picked from commit b30ee26)

Co-authored-by: Ravi Teja P <rvteja92@gmail.com>

Signed-off-by: Tapas Kundu <tkundu@vmware.com>
@ned-deily ned-deily merged commit cfc7ff8 into python:3.6 Jun 30, 2020
@sshuklao
Copy link

Can we get the new build of Python 3.6 which has this fix available publically?

@sshuklao
Copy link

@ned-deily ^^^

@ned-deily
Copy link
Member

ned-deily commented Jul 11, 2020 •
edited
Loading

@sshuklao Just to be clear, we do not provide builds, as in binary builds, for Python versions, like 3.6, that are in the security-fix phase of their life cycle. For 3.6, our policy has been to provide periodic source-only releases that rollup any new fixes since the previous rollup. The most recent rollup was just a few weeks ago, several days before this fix was published. There is a fix for a different problem that has also been published since then, so we may do the next rollup sooner than usual. We expect that third-party distributors supporting 3.6 will pick up fixes according to their support policies. If you are on your own and/or need the fix immediately, you can always apply the latest fixes yourself from the cpython GitHub repo 3.6 branch, either using git directly (https://github.com/python/cpython/tree/3.6) or you can download a GitHub-produced zip archive of the current state of the branch (https://github.com/python/cpython/archive/3.6.zip).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@corona10 corona10 corona10 approved these changes

@ned-deily ned-deily ned-deily approved these changes

@ericvsmith ericvsmith Awaiting requested review from ericvsmith

Assignees
No one assigned
Labels
type-security A security issue
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
6 participants
@tapakund @corona10 @ned-deily @sshuklao @the-knights-who-say-ni @bedevere-bot