Skip to content

Release 24.0.post5

Choose a tag to compare

View all tags
@icanhasmath icanhasmath released this 03 Nov 22:23
· 0 commits to main since this release
24.0.post5
fa2e746
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

ActiveState security release on the Python 3.7 pip 24.0 line. Merged in #17. It carries everything in 24.0.post4 plus the fix below.

CVE Advisory Status
CVE-2024-3651 GHSA-jjg7-2v4v-x38h Patched (vendored idna)

What changed:

  • Vendored idna 3.4 → 3.7, the upstream release that fixes CVE-2024-3651 (quadratic CONTEXTJ check on crafted labels). The tree is byte-identical to the vendored idna in upstream pip 24.1 and to the idna 3.7 wheel. idna 3.7 supports Python 3.5+, so it runs unchanged on 3.7.
  • Regression test tests/unit/test_vendored_idna.py counts joining-type lookups instead of timing: it passes here and fails on 24.0.post4 (270,300 lookups for the crafted label).
  • Vendored urllib3 (1.26.20.post4), requests (2.31.0 with backports) and certifi (2026.10.23) are unchanged from 24.0.post4.

Validated on the built wheel, in python:3.7-slim:

  • Versions: pip reports 24.0.post5, with vendored idna 3.7, urllib3 1.26.20 (the fork), requests 2.31.0 and certifi 2026.10.23.
  • CVE-2024-3651: a crafted 6,002-character label is rejected in 0.002 s (about 2 s on 24.0.post4 at a third of that size, growing quadratically).
  • 24.0.post4 checks still pass (.netrc host lookup, planted cacert.pem).
  • Network: a real pip download, a resolve, and running pip from the zipped wheel all work.

sha256

  • pip-24.0.post5.tar.gz: 43609eceea9ee23bcf1c1c7e977a19a91fd1d7c549d8d0548b055eeeb728f3aa
  • pip-24.0.post5-py3-none-any.whl: d9d6b5a5217f2745c1f719e62076cffb924d038dd3833732858f884a131d3b69
Assets 4
Loading