Repository navigation
Update Windows builds to use latest zlib #111239
Description
Bug report
Bug description:
A new version of zlib is out: 1.3 - https://zlib.net/
zlib 1.2.13 has CVE-2023-45853
https://www.openwall.com/lists/oss-security/2023/10/20/9
minizip is part of the contrib directory in zlib, but we do not appear to use this API. The CVSS v3 score is 9.8.
We would rather patch Python to use the latest library because people will ask us about that CVE.
CPython versions tested on:
3.11, 3.12, 3.13
Operating systems tested on:
Linux, Windows
Linked PRs
- gh-111239: Update Windows builds to zlib 1.3 #111242
- gh-111239: Update Windows build to use zlib 1.3.1 #114877
- [3.12] gh-111239: Update Windows build to use zlib 1.3.1 (GH-114877) #115076
- [3.10] gh-111239: Update Windows build to use zlib 1.3.1 (GH-114877) #115079
- [3.11] gh-111239: Update Windows build to use zlib 1.3.1 (GH-114877) #115080
- [3.8] gh-111239: Update Windows build to use zlib 1.3.1 (GH-114877) #115086
- [3.9] gh-111239: Update Windows build to use zlib 1.3.1 (GH-114877) #115087
Activity
zware commentedon Oct 24, 2023
There is not a release with a fix for CVE-2023-45853 yet, and we aren't using the affected API anyway. We should probably update 3.13 to 1.3.1 when it becomes available, and probably update 3.11-3.12 to 1.2.14 if it appears. But until there's a release, there's nothing for us to do here. As such, I'm going to go ahead and close the current PR but leave this issue open.
Thanks for bringing this to our attention!
zware commentedon Oct 24, 2023
I'm going to mark this as a 'deferred-blocker': we don't want to forget about it before final releases, but it's also not a release blocker.
[-]Update binary builds to use zlib 1.3[/-][+]Update Windows builds to use latest zlib[/+]Import zlib 1.3.1 from https://zlib.net/zlib-1.3.1.tar.gz
pythongh-111239: Update Windows build to use zlib 1.3.1
17 remaining items
[3.8] pythongh-111239: Update Windows build to use zlib 1.3.1 (python…
[3.9] pythongh-111239: Update Windows build to use zlib 1.3.1 (python…
[3.12] gh-111239: Update Windows build to use zlib 1.3.1 (GH-114877) (G…
[3.11] gh-111239: Update Windows build to use zlib 1.3.1 (GH-114877) (G…
[3.9] gh-111239: Update Windows build to use zlib 1.3.1 (GH-114877) (G…
[3.8] gh-111239: Update Windows build to use zlib 1.3.1 (GH-114877) (#…
ambv commentedon Feb 6, 2024
3.8 - 3.13 updated. This can be closed.
zware commentedon Feb 6, 2024
Sorry for the confusion, was just trying to raise visibility before impending releases.
pythongh-111239: Update Windows build to use zlib 1.3.1 (pythonGH-114877
lanzkron commentedon Nov 13, 2024
Am I missing something? I just installed Python 3.12.7 and got zlib1.dll v 1.2.13.0.
zware commentedon Nov 13, 2024
It looks like
zlib1.dllis just for Tcl/Tk, and probably is actually v1.2.13. I believe thezlibused by Python itself is statically linked, and is actually v1.3.1 (seezlib.ZLIB_VERSION).