Description

hartwork

opened on Feb 13, 2024

Issue body actions

Bug report

Bug description:

Hi! 👋

Please upgrade bundled Expat to 2.6.0 (e.g. for the fix to CVE-2023-52425).

• GitHub release: https://github.com/libexpat/libexpat/releases/tag/R_2_6_0
• Change log: https://github.com/libexpat/libexpat/blob/R_2_6_0/expat/Changes

The CPython issue for previous 2.5.0 was #98739 and the related merged pull request was #98742, in case you want to have a look. In particular comment #98742 (review) could be of help.

Thanks in advance!

CPython versions tested on:

3.8, 3.9, 3.10, 3.11, 3.12, 3.13, CPython main branch

Operating systems tested on:

Linux, macOS, Windows, Other

Linked PRs

• gh-115399: Upgrade bundled libexpat to 2.6.0 #115431
• [3.11] Upgrade bundled libexpat to 2.6.0 (GH-115399) #115468
• [3.12] gh-115399: Upgrade bundled libexpat to 2.6.0 (GH-115431) #115469
• [3.10] Upgrade bundled libexpat to 2.6.0 (GH-115399) (GH-115468) #115473
• [3.9] Upgrade bundled libexpat to 2.6.0 (GH-115399) #115474
• [3.8] Upgrade bundled libexpat to 2.6.0 (GH-115399) #115475
• gh-115399: Document CVE-2023-52425 under "XML vulnerabilities" #115400
• [3.12] gh-115399: Document CVE-2023-52425 under "XML vulnerabilities" (GH-115400) #115760
• [3.11] gh-115399: Document CVE-2023-52425 under "XML vulnerabilities" (GH-115400) #115761
• [3.10] gh-115399: Document CVE-2023-52425 under "XML vulnerabilities" (GH-115400) #115762
• [3.9] gh-115399: Document CVE-2023-52425 under "XML vulnerabilities" (GH-115400) #115763
• [3.8] gh-115399: Document CVE-2023-52425 under "XML vulnerabilities" (GH-115400) #115764

Reacted by Łukasz Langa

Reacted by Seth Larson

Activity

1. hartwork

   added

   type-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error

   on Feb 13, 2024
2. erlend-aasland

   added

   extension-modulesC modules in the Modules dirC modules in the Modules dir

   on Feb 13, 2024
3. ambv commented on Feb 13, 2024

   

   ambv

   on Feb 13, 2024

   Contributor

   More actions

   Thanks for letting us know. We'll be addressing this.

   Reacted by Sebastian Pipping
4. bedevere-app commented on Feb 14, 2024

   

   bedevere-appBot

   on Feb 14, 2024

   More actions

   GH-115468 is a backport of this pull request to the 3.11 branch.
5. Yhg1s

   closed this as completedin #115431on Feb 14, 2024
6. Yhg1s

   added a commit that references this issue on Feb 14, 2024

   gh-115399: Upgrade bundled libexpat to 2.6.0 (#115431)

   4b2d178
7. miss-islington

   added a commit that references this issue on Feb 14, 2024

   pythongh-115399: Upgrade bundled libexpat to 2.6.0 (pythonGH-115431)

   f601dee
8. ambv

   added a commit that references this issue on Feb 14, 2024

   [3.11] Upgrade bundled libexpat to 2.6.0 (GH-115399) (GH-115468)

   e071b0d
9. miss-islington

   added a commit that references this issue on Feb 14, 2024

   [3.11] Upgrade bundled libexpat to 2.6.0 (pythonGH-115399) (pythonGH-…

   e711c8e
10. sethmlarson

    added a commit that references this issue on Feb 14, 2024

    [3.9] [3.11] Upgrade bundled libexpat to 2.6.0 (pythonGH-115399) (pyt…

    2740bfa
11. bedevere-app commented on Feb 14, 2024

    

    bedevere-appBot

    on Feb 14, 2024

    More actions

    GH-115474 is a backport of this pull request to the 3.9 branch.
12. sethmlarson

    added a commit that references this issue on Feb 14, 2024

    [3.8] [3.11] Upgrade bundled libexpat to 2.6.0 (pythonGH-115399) (pyt…

    10de572
13. bedevere-app commented on Feb 14, 2024

    

    bedevere-appBot

    on Feb 14, 2024

    More actions

    GH-115475 is a backport of this pull request to the 3.8 branch.
14. sethmlarson

    added 2 commits that reference this issue on Feb 14, 2024

    [3.9] Upgrade bundled libexpat to 2.6.0 (pythonGH-115399) (pythonGH-1…

    b5762ec

    [3.8] Upgrade bundled libexpat to 2.6.0 (pythonGH-115399) (pythonGH-1…

    68dd471
15. 4 remaining items
16. miss-islington

    added 5 commits that reference this issue on Feb 21, 2024

    pythongh-115399: Document CVE-2023-52425 under "XML vulnerabilities" (p…

    0873ae7

    pythongh-115399: Document CVE-2023-52425 under "XML vulnerabilities" (p…

    d80a4cf

    pythongh-115399: Document CVE-2023-52425 under "XML vulnerabilities" (p…

    af23c8c

    pythongh-115399: Document CVE-2023-52425 under "XML vulnerabilities" (p…

    d5fd04b

    pythongh-115399: Document CVE-2023-52425 under "XML vulnerabilities" (p…

    bd8c826
17. ambv

    added 7 commits that reference this issue on Feb 21, 2024

    [3.12] gh-115399: Document CVE-2023-52425 under "XML vulnerabilities" (…

    cab8d07

    [3.11] gh-115399: Document CVE-2023-52425 under "XML vulnerabilities" (…

    6928d5e

    [3.10] gh-115399: Document CVE-2023-52425 under "XML vulnerabilities" (…

    b612ec6

    [3.8] gh-115399: Document CVE-2023-52425 under "XML vulnerabilities" (G…

    1e7f79a

    [3.9] gh-115399: Document CVE-2023-52425 under "XML vulnerabilities" (G…

    0397866

    [3.9] Upgrade bundled libexpat to 2.6.0 (GH-115399) (GH-115474)

    4b68e5d

    [3.8] Upgrade bundled libexpat to 2.6.0 (GH-115399) (GH-115475)

    8c6f277
18. woodruffw

    added a commit that references this issue on Mar 4, 2024

    pythongh-115399: Document CVE-2023-52425 under "XML vulnerabilities" (p…

    1aae53b
19. diegorusso

    added a commit that references this issue on Apr 17, 2024

    pythongh-115399: Document CVE-2023-52425 under "XML vulnerabilities" (p…

    46450e5
20. LukasWoodtli

    added a commit that references this issue on Jan 22, 2025

    pythongh-115399: Document CVE-2023-52425 under "XML vulnerabilities" (p…

    5f85da6

Issue actions