f



[RELEASED] Release candidates for Python 2.6.8, 2.7.3, 3.1.5, and 3.2.3

We're pleased to announce the immediate availability of release candidates for
Python 2.6.8, 2.7.3, 3.1.5, and 3.2.3 . The main impetus for these releases is
fixing a security issue in Python's hash based types, dict and set, as described
below. Python 2.7.3 and 3.2.3 include the security patch and the normal set of
bug fixes. Since Python 2.6 and 3.1 are maintained only for security issues,
2.6.8 and 3.1.5 contain only various security patches.

The security issue exploits Python's dict and set implementations. Carefully
crafted input can lead to extremely long computation times and denials of
service. [1] Python dict and set types use hash tables to provide amortized
constant time operations. Hash tables require a well-distributed hash function
to spread data evenly across the hash table. The security issue is that an
attacker could compute thousands of keys with colliding hashes; this causes
quadratic algorithmic complexity when the hash table is constructed. To
alleviate the problem, the new releases add randomization to the hashing of
Python's string types (bytes/str in Python 3 and str/unicode in Python 2),
datetime.date, and datetime.datetime. This prevents an attacker from computing
colliding keys of these types without access to the Python process.

Hash randomization causes the iteration order of dicts and sets to be
unpredictable and differ across Python runs. Python has never guaranteed
iteration order of keys in a dict or set, and applications are advised to never
rely on it. Historically, dict iteration order has not changed very often across
releases and has always remained consistent between successive executions of
Python. Thus, some existing applications may be relying on dict or set ordering.
Because of this and the fact that many Python applications which don't accept
untrusted input are not vulnerable to this attack, in all stable Python releases
mentioned here, HASH RANDOMIZATION IS DISABLED BY DEFAULT. There are two ways to
enable it. The -R commandline option can be passed to the python executable. It
can also be enabled by setting an environmental variable PYTHONHASHSEED to
"random". (Other values are accepted, too; pass -h to python for complete
description.)

More details about the issue and the patch can be found in the oCERT advisory
[1] and the Python bug tracker [2].

These releases are releases candidates and thus not recommended for production
use. Please test your applications and libraries with them, and report any bugs
you encounter. We are especially interested in any buggy behavior observed using
hash randomization. Excepting major calamity, final versions should appear after
several weeks.

Downloads are at

    http://python.org/download/releases/2.6.8/
    http://python.org/download/releases/2.7.3/
    http://python.org/download/releases/3.1.5/
    http://python.org/download/releases/3.2.3/

Please test these candidates and report bugs to

    http://bugs.python.org/

With regards,
The Python release team
Barry Warsaw (2.6), Georg Brandl (3.2), Benjamin Peterson (2.7 and 3.1)

[1] http://www.ocert.org/advisories/ocert-2011-003.html
[2] http://bugs.python.org/issue13703
0
Benjamin
2/25/2012 5:56:15 PM
comp.lang.python.announce 7374 articles. 0 followers. Post Follow

0 Replies
2411 Views

Similar Articles

[PageSpeed] 15

Reply:

Similar Artilces:

[RELEASED] Second release candidates for Python 2.6.8, 2.7.3, 3.1.5, and 3.2.3
We're chuffed to announce the immediate availability of the second release candidates for Python 2.6.8, 2.7.3, 3.1.5, and 3.2.3. The only change from the first release candidates is the patching of an additional security hole. The security issue fixed in the second release candidates is in the expat XML parsing library. expat had the same hash security issue detailed below as Python's core types. The hashing algorithm used in the expat library is now randomized. A more thorough explanation of the "hash attack" security hole follows. The main impetus for these releases is fi...

[RELEASED] Second release candidates for Python 2.6.8, 2.7.3, 3.1.5, and 3.2.3
We're chuffed to announce the immediate availability of the second release candidates for Python 2.6.8, 2.7.3, 3.1.5, and 3.2.3. The only change from the first release candidates is the patching of an additional security hole. The security issue fixed in the second release candidates is in the expat XML parsing library. expat had the same hash security issue detailed below as Python's core types. The hashing algorithm used in the expat library is now randomized. A more thorough explanation of the "hash attack" security hole follows. The main impetus for these releases is fixing a security issue in Python's hash based types, dict and set, as described below. Python 2.7.3 and 3.2.3 include the security patch and the normal set of bug fixes. Since Python 2.6 and 3.1 are maintained only for security issues, 2.6.8 and 3.1.5 contain only various security patches. The security issue exploits Python's dict and set implementations. Carefully crafted input can lead to extremely long computation times and denials of service. [1] Python dict and set types use hash tables to provide amortized constant time operations. Hash tables require a well-distributed hash function to spread data evenly across the hash table. The security issue is that an attacker could compute thousands of keys with colliding hashes; this causes quadratic algorithmic complexity when the hash table is constructed. To alleviate the problem, the new releases add rando...

Problem installing matplotlib 1.3.1 with Python 2.7.6 and 3.3.3 (release candidate 1)
Hello, I tried to install matplotlib 1.3.1 on the release candidates of Python 2.7.6 and 3.3.3. I am on Mac OS X 10.6.8. Although the installation gave no problems, there is a problem with Tcl/Tk. The new Pythons have their own embedded Tcl/Tk, but when installing matplotlib it links to the Frameworks version of Tcl and TK, not to the embedded version. This causes confusion when importing matplotlib.pyplot: objc[70648]: Class TKApplication is implemented in both /Library/Frameworks/Python.framework/Versions/2.7/lib/libtk8.5.dylib and /Library/Frameworks/Tk.framework/Versions/8.5/Tk....

[RELEASED] Python 3.2.5 and Python 3.3.2
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On behalf of the Python development team, I am pleased to announce the releases of Python 3.2.5 and 3.3.2. The releases fix a few regressions in 3.2.4 and 3.3.1 in the zipfile, gzip and xml.sax modules. Details can be found in the changelogs: http://hg.python.org/cpython/file/v3.2.5/Misc/NEWS and http://hg.python.org/cpython/file/v3.3.2/Misc/NEWS To download Python 3.2.5 or Python 3.3.2, visit: http://www.python.org/download/releases/3.2.5/ or http://www.python.org/download/releases/3.3.2/ respectively. As...

[RELEASED] Python 3.2.5 and Python 3.3.2
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On behalf of the Python development team, I am pleased to announce the releases of Python 3.2.5 and 3.3.2. The releases fix a few regressions in 3.2.4 and 3.3.1 in the zipfile, gzip and xml.sax modules. Details can be found in the changelogs: http://hg.python.org/cpython/file/v3.2.5/Misc/NEWS and http://hg.python.org/cpython/file/v3.3.2/Misc/NEWS To download Python 3.2.5 or Python 3.3.2, visit: http://www.python.org/download/releases/3.2.5/ or http://www.python.org/download/releases/3.3.2/ respectively. As always, please report bugs to http://bugs.python.org/ (Thank you to those who reported these regressions.) Enjoy! - -- Georg Brandl, Release Manager georg at python.org (on behalf of the entire python-dev team and all contributors) -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.19 (GNU/Linux) iEYEARECAAYFAlGUbJ4ACgkQN9GcIYhpnLDH8ACdEM4k7bobLJsFmCb49zuwQR3W EjgAoIWAOFNhJNdTAWEGSWqFWUP20wrb =YnPr -----END PGP SIGNATURE----- ...

how can i write this statement labels=[1;1;1;1;1;1;1;1;1;1;1;1;1;1;1;1;1;1;1;1;1;1;1;1;2;2;2;2;2;2;2;2;2;2;2;2;2;2;2;2;2;2;2;2;2;2;2;2;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;]; in compress fo
How to write it in compact form to avoid repetition "shah " <shahkhn3@gmail.com> wrote in message <lodugh$8hr$1@newscl01ah.mathworks.com>... > How to write it in compact form to avoid repetition You'll find in this thread different solutions for similar question http://www.mathworks.fr/matlabcentral/newsreader/view_thread/335814 Bruno ...

[RELEASED] Python 3.2.6, Python 3.3.6
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On behalf of the Python development team, I'm happy to announce the release of Python 3.2.6 and 3.3.6. Both are security-fix releases, which are provided source-only on python.org. The list of security-related issues fixed in the releases is given in the changelogs: https://hg.python.org/cpython/raw-file/v3.2.6/Misc/NEWS https://hg.python.org/cpython/raw-file/v3.3.6/Misc/NEWS To download the releases visit one of: https://www.python.org/downloads/release/python-326/ https://www.python.org/downloads/release/...

[RELEASED] Python 3.2.6, Python 3.3.6
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On behalf of the Python development team, I'm happy to announce the release of Python 3.2.6 and 3.3.6. Both are security-fix releases, which are provided source-only on python.org. The list of security-related issues fixed in the releases is given in the changelogs: https://hg.python.org/cpython/raw-file/v3.2.6/Misc/NEWS https://hg.python.org/cpython/raw-file/v3.3.6/Misc/NEWS To download the releases visit one of: https://www.python.org/downloads/release/python-326/ https://www.python.org/downloads/release/...

[RELEASED] Python 3.3.3 release candidate 2
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On behalf of the Python development team, I'm quite happy to announce the Python 3.3.3 release candidate 2. Python 3.3.3 includes several security fixes and over 150 bug fixes compared to the Python 3.3.2 release. This release fully supports OS X 10.9 Mavericks. In particular, this release fixes an issue that could cause previous versions of Python to crash when typing in interactive mode on OS X 10.9. Python 3.3 includes a range of improvements of the 3.x series, as well as easier porting between 2.x and 3.x. In total, almost 500 API items are new or improved in Python 3.3. For a more extensive list of changes in the 3.3 series, see http://docs.python.org/3.3/whatsnew/3.3.html To download Python 3.3.3 rc2 visit: http://www.python.org/download/releases/3.3.3/ This is a preview release, please report any bugs to http://bugs.python.org/ Enjoy! - -- Georg Brandl, Release Manager georg at python.org (on behalf of the entire python-dev team and 3.3's contributors) -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) iEYEARECAAYFAlKB1G4ACgkQN9GcIYhpnLAu5gCfRkfpnEs+rmtZ9iTjaaZcHDx3 sNYAn180Q4cFZmKtwJdaG+g/3jHAVd97 =n/Tt -----END PGP SIGNATURE----- ...

[RELEASED] Python 3.3.3 release candidate 2
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On behalf of the Python development team, I'm quite happy to announce the Python 3.3.3 release candidate 2. Python 3.3.3 includes several security fixes and over 150 bug fixes compared to the Python 3.3.2 release. This release fully supports OS X 10.9 Mavericks. In particular, this release fixes an issue that could cause previous versions of Python to crash when typing in interactive mode on OS X 10.9. Python 3.3 includes a range of improvements of the 3.x series, as well as easier porting between 2.x and 3.x. In total, almo...

Upgrade from VO 1 - 2 - 2..1 -2.2 - 2.3 -2.4 - 2.5 - 2.6 - 2.7
About upgrade 2.5 - 2.7 at $ 384.00 For most products I'm using - the updates (2.0 - 2.1 - 2.7) are free... 2.0 to 3.0 might be worth + 10-30% of the original price? VO is + full price again & again - Full program price for every minor upgrade/bug-fix? I dropped out of the money/bugs [VO] at 2.5 after starting at 1.0 more than 10 years ago. Certainly whoever is making VO have to make a living; earning moneys: - that is OK! A 10 years old VO site; - 10 years later, how much have changed? http://www.yi.com/prany/cavo/cavofront.htm Even MS is not ...

[1 1 1 1 1 ;2 2 2 2 2 ;3 3 3 3 3 3;....;n n n n n]
Hi, Anybody knows how to create this matrix but without using any loops? a=[1 1 1 1 1 ;2 2 2 2 2 ;3 3 3 3 3 ;.......;n n n n n ] Thank you. Hana. Hana wrote: > Hi, > Anybody knows how to create this matrix but without using any loops? > a=[1 1 1 1 1 ;2 2 2 2 2 ;3 3 3 3 3 ;.......;n n n n n ] HELP REPMAT - Randy Hana wrote: > > > Hi, > Anybody knows how to create this matrix but without using any > loops? > a=[1 1 1 1 1 ;2 2 2 2 2 ;3 3 3 3 3 ;.......;n n n n n ] > > Thank you. > Hana. Hope this isn't homework. >> repmat([1:n]'...

[RELEASED] Python 3.2.4 and Python 3.3.1
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On behalf of the Python development team, I am pleased to announce the final releases of Python 3.2.4 and 3.3.1. Python 3.2.4 is the final regular maintenance release for the Python 3.2 series, while Python 3.3.1 is the first maintenance release for the 3.3 series. Both releases include hundreds of bugfixes. There has recently been a lot of discussion about XML-based denial of service attacks. Specifically, certain XML files can cause XML parsers, including ones in the Python stdlib, to consume gigabytes of RAM and swamp the CPU. These releases do not include any changes in Python XML code to address these issues. Interested parties should examine the defusedxml package on PyPI: https://pypi.python.org/pypi/defusedxml To download Python 3.2.4 or Python 3.3.1, visit: http://www.python.org/download/releases/3.2.4/ or http://www.python.org/download/releases/3.3.1/ respectively. As always, please report bugs to http://bugs.python.org/ Enjoy! - -- Georg Brandl, Release Manager georg at python.org (on behalf of the entire python-dev team and all contributors) -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.19 (GNU/Linux) iEYEARECAAYFAlFgiN8ACgkQN9GcIYhpnLAXxQCdHAd2lECpYfmYM4Wbd3I01es4 898AoKBDvHtgecD/PeVRKUrdQRSWGPJg =K8RQ -----END PGP SIGNATURE----- On Saturday, 6 April 2013 21:43:11 UTC+1, Georg Brandl wrote: > -----BEGIN PGP SIGNED MESSAGE----- > > Hash...

[RELEASED] Python 3.2.4 rc 1 and Python 3.3.1 rc 1
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On behalf of the Python development team, I am pleased to announce the first release candidates of Python 3.2.4 and 3.3.1. Python 3.2.4 will be the last regular maintenance release for the Python 3.2 series, while Python 3.3.1 is the first maintenance release for the 3.3 series. Both releases include hundreds of bugfixes. There has recently been a lot of discussion about XML-based denial of service attacks. Specifically, certain XML files can cause XML parsers, including ones in the Python stdlib, to consume gigabytes of RAM and swamp the CPU. These releases do not include any changes in Python XML code to address these issues. Interested parties should examine the defusedxml package on PyPI: https://pypi.python.org/pypi/defusedxml These are testing releases: Please consider trying them with your code and reporting any bugs you may notice to: http://bugs.python.org/ To download Python 3.2.4 or Python 3.3.1, visit: http://www.python.org/download/releases/3.2.4/ or http://www.python.org/download/releases/3.3.1/ respectively. Enjoy! - -- Georg Brandl, Release Manager georg at python.org (on behalf of the entire python-dev team and all contributors) -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.19 (GNU/Linux) iEYEARECAAYFAlFRRIoACgkQN9GcIYhpnLD6jACgnzYdYRKZ4kwkKeN3zSLSZ3Zr M/IAn17vlpxI3a3xk+i/ODOrCkMnRZro =B5sA -----END PGP SIGNATURE----- ...

[RELEASED] Python 3.2.4 rc 1 and Python 3.3.1 rc 1
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On behalf of the Python development team, I am pleased to announce the first release candidates of Python 3.2.4 and 3.3.1. Python 3.2.4 will be the last regular maintenance release for the Python 3.2 series, while Python 3.3.1 is the first maintenance release for the 3.3 series. Both releases include hundreds of bugfixes. There has recently been a lot of discussion about XML-based denial of service attacks. Specifically, certain XML files can cause XML parsers, including ones in the Python stdlib, to consume gigabytes of RAM and swa...

python-2.7.3 vs python-3.2.3
Greetings; I have need of using a script written for python3, but the default python on wheezy is 2.7.3. I see in the wheezy repos that 3.2.3-6 is available. Can/will they co-exist peacefully? Thank you. Cheers, Gene Heskett -- "There are four boxes to be used in defense of liberty: soap, ballot, jury, and ammo. Please use in that order." -Ed Howdershelt (Author) Genes Web page <http://geneslinuxbox.net:6309/gene> On 26/01/16 13:26, Gene Heskett wrote: > Greetings; > > I have need of using a script written for python3, but the default pytho...

[RELEASED] Python 3.1.3 release candidate 1 #2
On behalf of the Python development team, I'm gladsome to announce a release candidate of the third bugfix release for the Python 3.1 series, Python 3.1.3. This bug fix release fixes numerous issues found in 3.1.2. Please try it with your packages and report any bugs you find. The final of 3.1.3 is scheduled to be released in two weeks. The Python 3.1 version series focuses on the stabilization and optimization of the features and changes that Python 3.0 introduced. For example, the new I/O system has been rewritten in C for speed. File system APIs that use unicode strings ...

[RELEASED] Python 3.3.5 release candidate 2
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On behalf of the Python development team, I'm happy to announce the release of Python 3.3.5, release candidate 2. Python 3.3.5 includes a fix for a regression in zipimport in 3.3.4 (see http://bugs.python.org/issue20621) and a few other bugs. Python 3.3 includes a range of improvements of the 3.x series, as well as easier porting between 2.x and 3.x. In total, almost 500 API items are new or improved in Python 3.3. For a more extensive list of changes in the 3.3 series, see http://docs.python.org/3.3/whatsnew/3.3.html ...

RELEASED Python 2.3.3 (release candidate 1)
--==_Exmh_1079726856P Content-Type: text/plain; charset=us-ascii On behalf of the Python development team and the Python community, I'm happy to announce the release of Python 2.3.3 (release candidate 1). Python 2.3.3 is a bug-fix release of Python 2.3. A couple of serious bugs related to weakrefs and the cyclic garbage collector have been fixed, along with a number of bugs in the standard library. See the release notes on the web page for more details. For more information on Python 2.3.3c1, including download links for various platforms, release notes, and known issues...

[RELEASED] Python 3.3.5 release candidate 2
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On behalf of the Python development team, I'm happy to announce the release of Python 3.3.5, release candidate 2. Python 3.3.5 includes a fix for a regression in zipimport in 3.3.4 (see http://bugs.python.org/issue20621) and a few other bugs. Python 3.3 includes a range of improvements of the 3.x series, as well as easier porting between 2.x and 3.x. In total, almost 500 API items are new or improved in Python 3.3. For a more extensive list of changes in the 3.3 series, see http://docs.python.org/3.3/whatsnew/3.3.html ...

RELEASED Python 2.3.3 (release candidate 1)
--==_Exmh_1079726856P Content-Type: text/plain; charset=us-ascii On behalf of the Python development team and the Python community, I'm happy to announce the release of Python 2.3.3 (release candidate 1). Python 2.3.3 is a bug-fix release of Python 2.3. A couple of serious bugs related to weakrefs and the cyclic garbage collector have been fixed, along with a number of bugs in the standard library. See the release notes on the web page for more details. For more information on Python 2.3.3c1, including download links for various platforms, release notes, and known issues, please see ...

Re: pymozilla ([Python-Dev] RELEASED Python 2.3.3 (release candidate 1)
[Brad Clements wrote] >I'd like to find out more about pymozilla.. It sounds very interesting pymozilla is is a proprietary application so I can't share the code. It's a modified python.exe with builtin Browser module - Python wrapped Gecko engine. Custom nsIProtocolHandler and zip-file-system Python module is used to get and load files(html,xml,css,images,Python code) from zip and to resolve and process all ".py" links and html forms. It's pretty like CGI, but no server is required. The main problem was to have it run from CD (client requirement) without installing anything (Mozilla/Python) Wiktor On Fri, 19 Dec 2003 04:30:53 +0100, "Wiktor Sadowski" <art@wiktorsadowski.com> wrote: >The main problem was to have it run from CD (client requirement) without >installing anything (Mozilla/Python) I had the same problem. I solved it using Webware and SQLite. -- JZ JZ <jroznfgre@jngpugbjreQBGbet.cy> writes: > On Fri, 19 Dec 2003 04:30:53 +0100, "Wiktor Sadowski" > <art@wiktorsadowski.com> wrote: > > >The main problem was to have it run from CD (client requirement) without > >installing anything (Mozilla/Python) > > I had the same problem. I solved it using Webware and SQLite. What's the problem? Does Python not like having nowhere to save .pyc files? John "John J. Lee" wrote: > > JZ <jroznfgre@jngpugbjreQBGbet.cy> writes: > > > ...

Changing (1,2,3,4,5...) to (1,1,2,2,3,3,4,4,5,5...)
Hi All, I have a column vector of numbers that I would like to extrapolate by "doubling up": e.g. turn 2 4 6 8 into: 2 2 4 4 6 6 8 8 any ideas on an easy vectorised way to do this? TIA, Rob v=repmat([2; 4; 6; 8].',2,1); v=v(:) "Robert Barrie" <askme@ifuwant.com> wrote in message <hlt7kp$rut$1@fred.mathworks.com>... > Hi All, > > I have a column vector of numbers that I would like to extrapolate by "doubling up": > > e.g. turn > 2 > 4 > 6 > 8 > > into: > 2 > 2 > 4 > 4 > 6 > 6 > 8 >...

Web resources about - [RELEASED] Release candidates for Python 2.6.8, 2.7.3, 3.1.5, and 3.2.3 - comp.lang.python.announce

Lists of films released by Disney - Wikipedia, the free encyclopedia
Text is available under the Creative Commons Attribution-ShareAlike License ;additional terms may apply. By using this site, you agree to the ...

Independent Horror Movie To Be Released Via Facebook Game?
There are movies , and there are Facebook games , and there are even Facebook games based on movies . And now, thanks to Cardiff, U.K.-based ...

Senator Reid has been released from the... - Senator Harry Reid - Facebook
Senator Reid has been released from the hospital and is back at home with his wife, Landra. As previously stated, he went to the hospital as ...

How is the Facebook Redesign Affecting Social Games? October Gaming Charts Released
... attention now to social games. How has the Facebook redesign affected the top game developers on Facebook? Inside Social Games has just released ...

faroo_p2p: 1000x Faster Spelling Correction: Source Code released http://t.co/oY18ohyd #faroo #search ...
faroo_p2p: 1000x Faster Spelling Correction: Source Code released http://t.co/oY18ohyd #faroo #search #algorithm

→ 5by5 Radio app released
Nice app to listen to our shows live, and buying it is a great way to support 5by5. We discussed its features and design decisions in the last ...

Lil Wayne Released From Hospital After Sizzurp Overdose - ENTV
Lil Wayne has just been released from the hospital just days after Overdosing on Sizzurp or Texas Tea. He was put into a medically induced coma ...

Men arrested in London attack on Emiratis released - The National
Metropolitan Police in the UK said the men will return on bail in June and be reinterviewed.

Mark DeFriest: Prison escape artist ‘Houdini’ could be released
“IF I was a rapist or murderer they would let me out. But I’m the idiot who made them look like idiots.”

400,000 Western School Prawns released into the Swan and Canning rivers
A total of 400,000 Western School Prawns were released into the Swan and Canning rivers on Tuesday afternoon, bumping up the number of prawns ...

Resources last updated: 3/3/2016 4:04:10 PM