Vuln in Python bundled with Windows release

[Chris Pavlina]

We're shipping Python 2.7.13 with the Windows release, which is subject to CVE-2017-1000158 (integer overflow resulting in possible ACE, [1]). This has been fixed in 2.7.14 (see "bpo-30657" in [2]) so we should upgrade to this before 5.0.

[1] https://nvd.nist.gov/vuln/detail/CVE-2017-1000158
[2] https://raw.githubusercontent.com/python/cpython/84471935ed2f62b8c5758fd544c7d37076fe0fa5/Misc/NEWS

[Chris Pavlina (pavlina-chris)]

Personally, I'd do an interim minor release 4.0.8, as it's fairly serious to be installing Pythons on users' machines with ACE vulns and swapping out the Python version should be pretty trivial.

[Wayne Stambaugh (stambaughw)]

Wouldn't this be a bump in the package version i.e. 4.0.7-2? Given that
there are no plans to change the kicad stable 4 source, using version
4.0.8 will be misleading at best.

On 1/1/2018 12:34 AM, Chris Pavlina wrote:
> Personally, I'd do an interim minor release 4.0.8, as it's fairly
> serious to be installing Pythons on users' machines with ACE vulns and
> swapping out the Python version should be pretty trivial.
>

[Chris Pavlina (pavlina-chris)]

Well sure - I don't know the details of the version numbering policy wrt external things like this, call it whatever you want.

[Nick Østergaard (nickoe)]

Should be fixed in the next nightlies.