Hi @rhdesmond, I'm closing this PR as well as #5638 because it's pretty clear from the available evidence that CVE-2009-2959 and CVE-2009-2967 were fixed in 0.7.11p3. The fix commit for CVE-2009-2959 and the fix commit for CVE-2009-2967 are both tagged with 0.7.11p3, and an archived copy of a securityfocus.com advisory that covers both vulnerabilities lists 0.7.11p3 as the fixed version. Although 0.7.11p3 no longer exists in PyPI, it is the first available patched version according to extant evidence, and anyone who wishes to upgrade to 0.7.12 or another later version to mitigate the issue is still welcome to do so.

Thanks for your interest in CVE-2009-2959 and CVE-2009-2967 and have a good week!

Ah, I see what happened. The sorting on https://pypi.org/project/buildbot/#history incorrectly listed the nonconformant versions after than the regular versions so I missed them. Seems like they also have unexpected behavior when encountering invalid versions that we are 😆. Guess we'll just have to accept these unless Pypi yanks them.

Thanks for looking into this!