Discussion:
Bug#1089071: bookworm-pu: package python3.11/3.11.2-6+deb12u5
Add Reply
Adrian Bunk
2024-12-04 21:40:02 UTC
Reply
Permalink
Package: release.debian.org
Severity: normal
Tags: bookworm moreinfo
User: ***@packages.debian.org
Usertags: pu
X-Debbugs-Cc: ***@debian.org, Matthias Klose <***@debian.org>

* CVE-2023-27043: Reject malformed addresses in email.parseaddr()
(Closes: #1059298)
* CVE-2024-6923: Encode newlines in headers in the email module
* CVE-2024-7592: Quadratic complexity parsing cookies with backslashes
* CVE-2024-9287: venv activation scripts did't quote paths
* CVE-2024-11168: urllib functions improperly validated bracketed hosts

Tagged moreinfo, as question to the security team whether they want
this in -pu or as DSA.
Salvatore Bonaccorso
2024-12-05 21:30:01 UTC
Reply
Permalink
Control: tags -1 - moreinfo

Hi Adrian,
Post by Adrian Bunk
Package: release.debian.org
Severity: normal
Tags: bookworm moreinfo
Usertags: pu
* CVE-2023-27043: Reject malformed addresses in email.parseaddr()
(Closes: #1059298)
* CVE-2024-6923: Encode newlines in headers in the email module
* CVE-2024-7592: Quadratic complexity parsing cookies with backslashes
* CVE-2024-9287: venv activation scripts did't quote paths
* CVE-2024-11168: urllib functions improperly validated bracketed hosts
Tagged moreinfo, as question to the security team whether they want
this in -pu or as DSA.
yes the point release route and batching this update together with
oters seems fine, in particular given the next point release is
scheduled to be in ~1 month.

Regards,
Salvatore
Debian Bug Tracking System
2024-12-05 21:30:02 UTC
Reply
Permalink
Post by Salvatore Bonaccorso
tags -1 - moreinfo
Bug #1089071 [release.debian.org] bookworm-pu: package python3.11/3.11.2-6+deb12u5
Removed tag(s) moreinfo.
--
1089071: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1089071
Debian Bug Tracking System
Contact ***@bugs.debian.org with problems
Jonathan Wiltshire
2024-12-06 13:50:01 UTC
Reply
Permalink
Control: tag -1 confirmed

Please go ahead.

Thanks,
--
Jonathan Wiltshire ***@debian.org
Debian Developer http://people.debian.org/~jmw

4096R: 0xD3524C51 / 0A55 B7C5 1223 3942 86EC 74C3 5394 479D D352 4C51
ed25519/0x196418AAEB74C8A1: CA619D65A72A7BADFC96D280196418AAEB74C8A1
Debian Bug Tracking System
2024-12-06 13:50:01 UTC
Reply
Permalink
Post by Jonathan Wiltshire
tag -1 confirmed
Bug #1089071 [release.debian.org] bookworm-pu: package python3.11/3.11.2-6+deb12u5
Added tag(s) confirmed.
--
1089071: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1089071
Debian Bug Tracking System
Contact ***@bugs.debian.org with problems
Jonathan Wiltshire
2024-12-08 11:30:01 UTC
Reply
Permalink
package release.debian.org
tags 1089071 = bookworm pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into the proposed-updates queue for Debian bookworm.

Thanks for your contribution!

Upload details
==============

Package: python3.11
Version: 3.11.2-6+deb12u5

Explanation:
Cyril Brulebois
2024-12-22 19:50:01 UTC
Reply
Permalink
Hi Adrian,
+ * CVE-2023-27043: Reject malformed addresses in email.parseaddr()
+ (Closes: #1059298)
https://docs.python.org/3/library/smtplib.html isn't quite clear about
what to_addrs should look like (unless you infer it from the example at the
bottom), and I ended up passing '***@example.org,***@example.org' in some
code, which has worked fine until this update.

The docstring is clearer though:

def sendmail(self, from_addr, to_addrs, msg, mail_options=(),
rcpt_options=()):
"""This command performs an entire mail transaction.

The arguments are:
- from_addr : The address sending this mail.
- to_addrs : A list of addresses to send this mail to. A bare
^^^^^^^^^^^^^^^^^^^
string will be treated as a list with 1 address.
- msg : The message to send.
- mail_options : List of ESMTP options (such as 8bitmime) for the
mail command.
- rcpt_options : List of ESMTP options (such as DSN commands) for
all the rcpt commands.

so I guess it's fair that the stricter check now rejects what's been
working for years.

I thought I'd drop you a note anyway, just in case others wonder why
they aren't getting any mails anymore and/or they get that kind of
traces:

Traceback (most recent call last):
File "/home/kibi/my_code.py", line 42, in send
Job.smtp.sendmail(from_addr, to_addr, message)
File "/usr/lib/python3.11/smtplib.py", line 901, in sendmail
raise SMTPRecipientsRefused(senderrs)
smtplib.SMTPRecipientsRefused: {'***@example.org,***@example.org': (501, b'5.1.3 Bad recipient address syntax')}


Cheers,
--
Cyril Brulebois (***@debian.org) <https://debamax.com/>
D-I release manager -- Release team member -- Freelance Consultant
Debian Bug Tracking System
2025-01-11 11:20:17 UTC
Reply
Permalink
Your message dated Sat, 11 Jan 2025 11:03:09 +0000
with message-id <E1tWZGn-009jaV-***@coccia.debian.org>
and subject line Close 1089071
has caused the Debian Bug report #1089071,
regarding bookworm-pu: package python3.11/3.11.2-6+deb12u5
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ***@bugs.debian.org
immediately.)
--
1089071: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1089071
Debian Bug Tracking System
Contact ***@bugs.debian.org with problems
Loading...