Repository navigation
Update binary builds to use zlib 1.2.13 #98689
Description
A new version of zlib is out: 1.2.13 - https://zlib.net/
zlib 1.2.12 has CVE-2022-37434:
https://www.openwall.com/lists/oss-security/2022/08/09/1
but... we do not appear to call the vulnerable inflateGetHeader API. So this is more of a thing we just need to do before the next round of binary builds rather than an urgent new windows binary release update as 1.2.12 was.
$ grep -i -c inflateGetHeader Modules/zlibmodule.c
0
Maybe this doesn't deserve the type-security label, but so long as our binary builds link with 1.2.12 people will ask us about that CVE.
Activity
Import zlib 1.2.13 from https://zlib.net/zlib-1.2.13.tar.gz
pythongh-98689: Update Windows builds to zlib 1.2.13
gh-98689: Update Windows builds to zlib v1.2.13 (GH-98968)
pythongh-98689: Update Windows builds to zlib v1.2.13 (pythonGH-98968)
pythongh-98689: Update Windows builds to zlib v1.2.13 (pythonGH-98968)
zware commentedon Nov 1, 2022
Since we no longer distribute binaries for 3.9 or before (and aren't actually vulnerable anyway), I don't think we should backport further than 3.10.
gh-98689: Update Windows builds to zlib v1.2.13 (GH-98968)
gh-98689: Update Windows builds to zlib v1.2.13 (GH-98968)
zware commentedon Nov 1, 2022
Done in: