Please fix CVE-2021-29921 in Python 3.8

[rolweber]

Hello Team Anaconda,

CVE-2021-29921 was reported against Python 3.8 and later:

• https://python-security.readthedocs.io/vuln/ipaddress-ipv4-leading-zeros.html
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29921

The Python community decided to fix it only in Python 3.9 and later:

• https://bugs.python.org/issue36384#msg392684

Could you please backport this fix to the Anaconda builds of Python 3.8?

• python/cpython@60ce8f0

[rolweber]

This will be fixed in Python 3.8.12 after all.
python/cpython#27801
https://bugs.python.org/issue36384#msg399801

[rolweber]

Anaconda has built Python 3.8.12 for most platforms now. An update for linux-s390x is pending.

[remkade]

Python 3.8.12 is now released on linux-s390x as well. All supported architectures should be updated.

Thanks!

[rolweber]

Thank you!