GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — [3.8] gh-108310: Fix TestPreHandshakeClose tests in test_ssl by frenzymadness · Pull Request #110718 · python/cpython

Conversation

@frenzymadness

@frenzymadness frenzymadness commented Oct 11, 2023 •
edited by bedevere-app Bot
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor

The new class is part of the fix for CVE-2023-40217: b4bcc06 but it's not in the lists of tests so they're not
executed. The new tests also need SHORT_TIMEOUT
constant not available in test.support in 3.8.

I'm using the original issue here as this change fixes the original testsuite for the CVE in TLS.

An alternative for having the constant in test_ssl is to backport this commit from 3.9: 24c6258 But it touches a lot of files and I think that might be too much for 3.8.

Cc the authors of the original fix: @ambv and @gpshead

  • Issue: CVE-2023-40217: Bypass TLS handshake on closed sockets #108310

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@frenzymadness
pythongh-108310: Fix TestPreHandshakeClose tests in test_ssl
7fa62f5 
The new class is part of the fix for CVE-2023-40217:
python@b4bcc06
but it's not in the lists of tests so they're not
executed. The new tests also need `SHORT_TIMEOUT`
constant not available in test.support in 3.8.
@frenzymadness
frenzymadness requested a review from tiran as a code owner October 11, 2023 13:42
@bedevere-app bedevere-app Bot added tests Tests in the Lib/test dir awaiting review labels Oct 11, 2023
@bedevere-app bedevere-app Bot mentioned this pull request Oct 11, 2023
CVE-2023-40217: Bypass TLS handshake on closed sockets #108310
Closed
2 tasks done
@ambv ambv changed the title gh-108310: Fix TestPreHandshakeClose tests in test_ssl [3.8] gh-108310: Fix TestPreHandshakeClose tests in test_ssl Oct 11, 2023
@ambv
Add Blurb
e82325a
gpshead
gpshead approved these changes Oct 11, 2023
View reviewed changes
@bedevere-app bedevere-app Bot added awaiting core review and removed awaiting review labels Oct 11, 2023
@ambv
ambv merged commit 0df2eb5 into python:3.8 Jan 17, 2024
@bedevere-app bedevere-app Bot removed the awaiting core review label Jan 17, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@gpshead gpshead gpshead approved these changes
@tiran tiran Awaiting requested review from tiran

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

tests Tests in the Lib/test dir

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

3 participants

@frenzymadness @gpshead @ambv
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.