GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — gh-160369: Reject buffered plaintext after IMAP STARTTLS by JelleZijlstra · Pull Request #160370 · python/cpython

Conversation

@JelleZijlstra

@JelleZijlstra JelleZijlstra commented Oct 22, 2026 •
edited by bedevere-app Bot
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Member

Reject unexpected plaintext buffered after the STARTTLS response before upgrading the connection, so it cannot be interpreted as TLS-protected server responses. Add regression coverage and a Security NEWS entry.

Closes #160369.

  • Issue: Reject buffered plaintext after IMAP STARTTLS #160369

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@JelleZijlstra
pythongh-160369: Reject buffered plaintext after IMAP STARTTLS
3ad1fa0
@bedevere-app bedevere-app Bot mentioned this pull request Oct 22, 2026
Reject buffered plaintext after IMAP STARTTLS #160369
Open
@JelleZijlstra JelleZijlstra added the type-security A security issue label Oct 22, 2026 — with ChatGPT Codex Connector
@JelleZijlstra
JelleZijlstra marked this pull request as ready for review October 22, 2026 22:01
@JelleZijlstra
JelleZijlstra requested a review from a team as a code owner October 22, 2026 22:01
@bedevere-app bedevere-app Bot added the awaiting core review label Oct 22, 2026
JelleZijlstra added 2 commits October 22, 2026 15:51
@JelleZijlstra
pythongh-160369: Reference CVE-2026-115559 in NEWS
0ca2fea
@JelleZijlstra
pythongh-160369: Use CVE metadata in NEWS
46f42ce
@sethmlarson sethmlarson added the release-blocker label Oct 29, 2026
@github-project-automation github-project-automation Bot added this to Release and Deferred blockers 🚫 Oct 29, 2026
@github-project-automation github-project-automation Bot moved this to Todo in Release and Deferred blockers 🚫 Oct 29, 2026
sethmlarson
sethmlarson reviewed Oct 29, 2026
View reviewed changes
Comment thread Lib/imaplib.py
if typ == 'OK':
if any(self._readbuf):
raise self.abort('unexpected data after STARTTLS response')
self._readbuf = []

@sethmlarson sethmlarson Oct 29, 2026

Copy link
Copy Markdown
Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We have to discard all cached state that could have been received before a STARTTLS command, so that includes untagged_responses, too. We should add a test for this case.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@savannahostrowski

savannahostrowski commented Nov 9, 2026

Copy link
Copy Markdown
Member

@JelleZijlstra @sethmlarson I was thinking it'd be good to get this into alpha 2 tomorrow if we can. Do you folks think that's doable?
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@sethmlarson

sethmlarson commented Nov 9, 2026 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor

@savannahostrowski I think so, @JelleZijlstra I can take over submitting a fix for my comment?
savannahostrowski reacted with heart emoji
All reactions
  • ❤️ 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@sethmlarson
Discard untagged_responses, add test case
55f6dda
@sethmlarson

sethmlarson commented Nov 9, 2026

Copy link
Copy Markdown
Contributor

@JelleZijlstra Pushed a fix here for you to review: 55f6dda
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
jelle-openai
jelle-openai reviewed Nov 9, 2026
View reviewed changes
Comment thread Lib/test/test_imaplib.py Outdated
ssl_context=ssl_context)
client.shutdown()

def test_starttls_discards_untagged_responses(self):

@jelle-openai jelle-openai Nov 9, 2026

Copy link
Copy Markdown
Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This test should be moved into NewIMAPTests, the SSL fixture already makes all commands run as TLS so we don't test what we need to test.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
sethmlarson reacted with thumbs up emoji
All reactions
  • 👍 1 reaction

@sethmlarson sethmlarson Nov 9, 2026

Copy link
Copy Markdown
Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Moved the test case in cfc62f0

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@sethmlarson
Move test to 'NewIMAPTests'
cfc62f0
hugovk
hugovk reviewed Nov 10, 2026
View reviewed changes
Comment thread Lib/test/test_imaplib.py Resolved

Uh oh!

There was an error while loading. Please reload this page.
@hugovk
Skip test when SSL not available
57f2469
@hugovk

hugovk commented Nov 10, 2026

Copy link
Copy Markdown
Member

I pushed a commit to skip a test when SSL not available: #160370 (comment). MSan now passes.
sethmlarson reacted with thumbs up emoji
All reactions
  • 👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@JelleZijlstra
JelleZijlstra merged commit 2f0e294 into python:main Nov 10, 2026
53 checks passed

Uh oh!

There was an error while loading. Please reload this page.
@github-project-automation github-project-automation Bot moved this from Todo to Done in Release and Deferred blockers 🚫 Nov 10, 2026
@bedevere-app bedevere-app Bot removed the awaiting core review label Nov 10, 2026
@JelleZijlstra JelleZijlstra added needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes needs backport to 3.13 only security fixes needs backport to 3.14 bugs and security fixes needs backport to 3.15 bugs and security fixes labels Nov 10, 2026
@miss-islington-app

miss-islington-app Bot commented Nov 10, 2026

Copy link
Copy Markdown

Thanks @JelleZijlstra for the PR 🌮🎉.. I'm working now to backport this PR to: 3.11.
🐍🍒⛏🤖
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@miss-islington-app

miss-islington-app Bot commented Nov 10, 2026

Copy link
Copy Markdown

Thanks @JelleZijlstra for the PR 🌮🎉.. I'm working now to backport this PR to: 3.12.
🐍🍒⛏🤖
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@miss-islington-app

miss-islington-app Bot commented Nov 10, 2026

Copy link
Copy Markdown

Thanks @JelleZijlstra for the PR 🌮🎉.. I'm working now to backport this PR to: 3.14.
🐍🍒⛏🤖
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@miss-islington-app

miss-islington-app Bot commented Nov 10, 2026

Copy link
Copy Markdown

Thanks @JelleZijlstra for the PR 🌮🎉.. I'm working now to backport this PR to: 3.13.
🐍🍒⛏🤖
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@miss-islington-app

miss-islington-app Bot commented Nov 10, 2026

Copy link
Copy Markdown

Thanks @JelleZijlstra for the PR 🌮🎉.. I'm working now to backport this PR to: 3.15.
🐍🍒⛏🤖
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@miss-islington-app

miss-islington-app Bot commented Nov 10, 2026

Copy link
Copy Markdown

Sorry, @JelleZijlstra, I could not cleanly backport this to 3.11 due to a conflict.

Please backport manually with cherry_picker, see the devguide for more information.

cherry_picker 2f0e294d85c905691e360586ebd1d1f7e7a1f5df 3.11
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@miss-islington-app miss-islington-app Bot assigned JelleZijlstra Nov 10, 2026
@miss-islington-app

miss-islington-app Bot commented Nov 10, 2026

Copy link
Copy Markdown

Sorry, @JelleZijlstra, I could not cleanly backport this to 3.12 due to a conflict.

Please backport manually with cherry_picker, see the devguide for more information.

cherry_picker 2f0e294d85c905691e360586ebd1d1f7e7a1f5df 3.12
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@miss-islington-app

miss-islington-app Bot commented Nov 10, 2026

Copy link
Copy Markdown

Sorry, @JelleZijlstra, I could not cleanly backport this to 3.14 due to a conflict.

Please backport manually with cherry_picker, see the devguide for more information.

cherry_picker 2f0e294d85c905691e360586ebd1d1f7e7a1f5df 3.14
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@miss-islington-app

miss-islington-app Bot commented Nov 10, 2026

Copy link
Copy Markdown

Sorry, @JelleZijlstra, I could not cleanly backport this to 3.13 due to a conflict.

Please backport manually with cherry_picker, see the devguide for more information.

cherry_picker 2f0e294d85c905691e360586ebd1d1f7e7a1f5df 3.13
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@miss-islington-app

miss-islington-app Bot commented Nov 10, 2026

Copy link
Copy Markdown

Sorry, @JelleZijlstra, I could not cleanly backport this to 3.15 due to a conflict.

Please backport manually with cherry_picker, see the devguide for more information.

cherry_picker 2f0e294d85c905691e360586ebd1d1f7e7a1f5df 3.15
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@JelleZijlstra JelleZijlstra mentioned this pull request Nov 10, 2026
[3.11] gh-160369: Discard cached responses after IMAP STARTTLS (GH-160370) #161757
Open
@bedevere-app

bedevere-app Bot commented Nov 10, 2026

Copy link
Copy Markdown

GH-161757 is a backport of this pull request to the 3.11 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.11 only security fixes label Nov 10, 2026
@JelleZijlstra JelleZijlstra mentioned this pull request Nov 10, 2026
[3.12] gh-160369: Discard cached responses after IMAP STARTTLS (GH-160370) #161758
Open
@bedevere-app

bedevere-app Bot commented Nov 10, 2026

Copy link
Copy Markdown

GH-161758 is a backport of this pull request to the 3.12 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.12 only security fixes label Nov 10, 2026
@JelleZijlstra JelleZijlstra mentioned this pull request Nov 10, 2026
[3.13] gh-160369: Discard cached responses after IMAP STARTTLS (GH-160370) #161759
Open
@bedevere-app

bedevere-app Bot commented Nov 10, 2026

Copy link
Copy Markdown

GH-161759 is a backport of this pull request to the 3.13 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.13 only security fixes label Nov 10, 2026
@JelleZijlstra JelleZijlstra mentioned this pull request Nov 10, 2026
[3.14] gh-160369: Reject buffered plaintext after IMAP STARTTLS (GH-160370) #161760
Open
@bedevere-app

bedevere-app Bot commented Nov 10, 2026

Copy link
Copy Markdown

GH-161760 is a backport of this pull request to the 3.14 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.14 bugs and security fixes label Nov 10, 2026
@JelleZijlstra JelleZijlstra mentioned this pull request Nov 10, 2026
[3.15] gh-160369: Reject buffered plaintext after IMAP STARTTLS (GH-160370) #161761
Open
@bedevere-app

bedevere-app Bot commented Nov 10, 2026

Copy link
Copy Markdown

GH-161761 is a backport of this pull request to the 3.15 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.15 bugs and security fixes label Nov 10, 2026
orsenthil pushed a commit to orsenthil/cpython that referenced this pull request Nov 12, 2026
@JelleZijlstra @sethmlarson
@hugovk @orsenthil
pythongh-160369: Reject buffered plaintext after IMAP STARTTLS (pytho…
da48492 
…n#160370)

Co-authored-by: Seth Michael Larson <[email protected]>
Co-authored-by: Hugo van Kemenade <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@hugovk hugovk hugovk left review comments
@sethmlarson sethmlarson sethmlarson left review comments
+1 more reviewer
@jelle-openai jelle-openai jelle-openai left review comments
Reviewers whose approvals may not affect merge requirements

Uh oh!

There was an error while loading. Please reload this page.

Assignees

@JelleZijlstra JelleZijlstra

Labels

release-blocker type-security A security issue

Projects

Release and Deferred blockers 🚫
Status: Done

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Reject buffered plaintext after IMAP STARTTLS

Uh oh!

There was an error while loading. Please reload this page.

5 participants

@JelleZijlstra @savannahostrowski @sethmlarson @hugovk @jelle-openai
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.