You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I've created a PR with a simple change that uses either Resolver().resolve() or Resolver().query() depending on which version of dnspython is installed. #302
Tested with both versions. I get test failures with TestNet.test_get_http_json but this seems to be unconnected with net.py code and failed before I made any changes and happens with either version of dnspython.
Haven't made any entry in the change log since there's already a note in there about fixing dnspython deprecation warnings.
I'm curious where this is at. I just started testing ipwhois, and it seems to work just fine with dnspython v2.0.0, at least with Python3. So not sure why the module's requirements are set to dnspython<=2.0.0 (I'd think if there's an issue b/w v1 and v2, it would've been written dnspython<2.
Current dnspython is 2.1.0. And as part of a devops team working on a project where we're already using the latest dnspython, trying to install ipwhois causes dnspython 2.1.0 to get uninstalled and 2.0.0 to be installed.
Reacted by Ian Hellen, Lionqueen94, auxsvr and Alex
This is the issue that I was trying to address in #302. If dnspython is installed first pip (depending on version) issues a warning or fails because of the <=2.0.0 requirement. The dnspython interface changed but not (as far as I can see) the basic functionality. The structure of the returned data from resolver.query() changes in post v2.0.0 resolver.resolve() but I can't see that this affects ipwhois functionality.
I think I will be dropping python 2 support. I updated requirements to latest for dnspython in dev branch. Will think about this some more before closing.
Just a heads up that CVE-2023-29483 (Medium 5.9) published April 2024 affects dnspython<=2.6.1 and thus this package too.
eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a "TuDoor" attack. In other w
4D66
ords, dnspython does not have the preferred behavior in which the DNS name resolution algorithm would proceed, within the full time window, in order to wait for a valid packet. NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1.
Activity
fseesink commentedon Feb 18, 2021
I'm curious where this is at. I just started testing ipwhois, and it seems to work just fine with dnspython v2.0.0, at least with Python3. So not sure why the module's requirements are set to
dnspython<=2.0.0(I'd think if there's an issue b/w v1 and v2, it would've been writtendnspython<2.Current dnspython is 2.1.0. And as part of a devops team working on a project where we're already using the latest dnspython, trying to install ipwhois causes dnspython 2.1.0 to get uninstalled and 2.0.0 to be installed.
ianhelle commentedon Feb 18, 2021
This is the issue that I was trying to address in #302. If dnspython is installed first pip (depending on version) issues a warning or fails because of the <=2.0.0 requirement. The dnspython interface changed but not (as far as I can see) the basic functionality. The structure of the returned data from resolver.query() changes in post v2.0.0 resolver.resolve() but I can't see that this affects ipwhois functionality.
secynic commentedon Oct 12, 2024
I think I will be dropping python 2 support. I updated requirements to latest for dnspython in dev branch. Will think about this some more before closing.
scottzach1 commentedon Jan 6, 2025
Just a heads up that CVE-2023-29483 (Medium 5.9) published April 2024 affects dnspython<=2.6.1 and thus this package too.