[issue45068] python 3.9.2 contains libcrypto-1_1.dll and libssl-1_1.dll associates CVE-2021-23840\CVE-2021-3450\CVE-2021-3711\CVE-2021-3712\CVE-2021-23841\CVE-2021-3449 of openssl-1.1.1i

2021-08-31 Thread Zachary Ware
Zachary Ware added the comment: v3.9.2 is rather out of date at this point; v3.9.7 was released just yesterday and includes OpenSSL v1.1.1l. If you're concerned about issues in the version of OpenSSL included with Python v3.9.2, you are encouraged to update to the latest v3.9.7, or replace

[issue45068] python 3.9.2 contains libcrypto-1_1.dll and libssl-1_1.dll associates CVE-2021-23840\CVE-2021-3450\CVE-2021-3711\CVE-2021-3712\CVE-2021-23841\CVE-2021-3449 of openssl-1.1.1i

2021-08-31 Thread xcl-1
New submission from xcl-1 <1318683...@qq.com>: Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return