XSS CVE-2017-15612

[junorouse]

CVE-2017-15612

See the commit log.

[junorouse]

@lepture

There is a problem in the CI.

C:/Python27
git clone -q https://github.com/lepture/mistune.git C:\projects\mistune
git fetch -q origin +refs/pull/140/merge:
git checkout -qf FETCH_HEAD
Running Install scripts
(new-object net.webclient).DownloadFile('https://bootstrap.pypa.io/get-pip.py', 'C:/get-pip.py')
Exception calling "DownloadFile" with "2" argument(s): "The request was aborted: Could not create SSL/TLS secure channel."
At line:1 char:1
+ (new-object net.webclient).DownloadFile('https://bootstrap.pypa.io/ge ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
    + FullyQualifiedErrorId : WebException
 
Command executed with exception: Exception calling "DownloadFile" with "2" argument(s): "The request was aborted: Could not create SSL/TLS secure channel."

????????????????

[SnarkBoojum]

You might change back the title to what it was, as the problem is public : CVE-2017-15612

[SnarkBoojum]

Will you release a new version of mistune soon with that fix or should I add the patch to the Debian packaging of the current version?

Thanks.

[lepture]

@SnarkBoojum It's already released.

https://github.com/lepture/mistune/blob/master/CHANGES.rst

[SnarkBoojum]

Oh, sorry, I didn't see : thanks!

[junorouse]

@SnarkBoojum Ok, I changed. Thanks.