NotificationsYou must be signed in to change notification settings
Fork32k
Star67.2k

[3.5] bpo-41004: Resolve hash collisions for IPv4Interface and IPv6In…#21233

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Jump to bottom

Merged

larryhastings merged 3 commits intopython:3.5fromtapakund:3.5

Aug 4, 2020

Merged

[3.5] bpo-41004: Resolve hash collisions for IPv4Interface and IPv6In…#21233

larryhastings merged 3 commits intopython:3.5fromtapakund:3.5

Aug 4, 2020

Conversation

Copy link

tapakund commentedJun 30, 2020•
edited by bedevere-bot
Loading

…terface (GH-21033)

Thehash() methods of classes IPv4Interface and IPv6Interface had issue
of generating constant hash values of 32 and 128 respectively causing hash collisions.
The fix uses the hash() function to generate hash values for the objects
instead of XOR operation
(cherry picked from commitb30ee26)

Co-authored-by: Ravi Teja Prvteja92@gmail.com

Signed-off-by: Tapas Kundutkundu@vmware.com

https://bugs.python.org/issue41004

the-knights-who-say-ni added the CLA signed label

Jun 30, 2020

bedevere-bot added the awaiting review label

Jun 30, 2020

Copy link

Member

corona10 commentedJun 30, 2020

Sorry, we only accept the security patch for 3.5-3.7.

I close this PR cc@ericvsmith

ref:https://devguide.python.org/#status-of-python-branches

corona10 closed this

Jun 30, 2020

corona10 reopened this

Jun 30, 2020

corona10 approved these changes

Jun 30, 2020

View reviewed changes

Copy link

Member

corona10 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Since this issue is reported as theCVE-2020-14422.
I am okay to merge this PR as the security issue.

But waiting for@ned-deily and@ericvsmith 's comment :)

bedevere-bot added awaiting merge and removed awaiting review labels

Jun 30, 2020

corona10 requested review fromericvsmith andned-deily

June 30, 2020 11:09

corona10 added the type-securityA security issue label

Jun 30, 2020

Copy link

Member

ned-deily commentedJun 30, 2020

The decision whether to merge to 3.5 is up to the 3.5 release manager,@larryhastings.

Copy link

Member

ned-deily commentedJun 30, 2020

As I noted on the bpo issue, I think the NEWS blurb should be updated to include the CVE.

[3.5] bpo-41004: Resolve hash collisions for IPv4Interface and IPv6In…

3e632dc

…terface (pythonGH-21033)The __hash__() methods of classes IPv4Interface and IPv6Interface had issueof generating constant hash values of 32 and 128 respectively causing hash collisions.The fix uses the hash() function to generate hash values for the objectsinstead of XOR operation(cherry picked from commitb30ee26)Co-authored-by: Ravi Teja P <rvteja92@gmail.com>Signed-off-by: Tapas Kundu <tkundu@vmware.com>