[issue36384] [security] CVE-2021-29921: ipaddress Should not reject IPv4 addresses with leading zeroes as ambiguously octal

2021-08-17 Thread Achraf Merzouki
Achraf Merzouki added the comment: >> it prevents using 3.8 because of this open vulnerability >What do you mean by this? >Our understanding is that this is a low-severity CVE because in order for this >to be a vulnerability, you'd have to have both: >1. user acc

[issue36384] [security] CVE-2021-29921: ipaddress Should not reject IPv4 addresses with leading zeroes as ambiguously octal

2021-08-17 Thread Achraf Merzouki
Achraf Merzouki added the comment: Can we backport the security fix from this issue https://bugs.python.org/issue36384#msg392684 to version 3.8 The comment explicitly says that it was decided to not include in 3.8, I am not sure this is best, since it prevents using 3.8 because of this open