Description

hartwork

opened on Mar 13, 2024

Issue body actions

Bug report

Bug description:

Hi! 👋

Please upgrade bundled Expat to 2.6.2 (e.g. for the fix to CVE-2024-28757).

• GitHub release: https://github.com/libexpat/libexpat/releases/tag/R_2_6_2
• Change log: https://github.com/libexpat/libexpat/blob/R_2_6_2/expat/Changes

The CPython issue for previous 2.6.0 was #115399 and the related merged main pull request was #115431, in case you want to have a look. Comment #115431 (comment) could be of help by raising confidence in the bump pull request when going forward.

Thanks in advance!

CPython versions tested on:

3.8, 3.9, 3.10, 3.11, 3.12, 3.13, CPython main branch

Operating systems tested on:

Linux, macOS, Windows, Other

Linked PRs

• gh-116741: Upgrade libexpat to 2.6.2 #117296
• [3.12] gh-116741: Upgrade libexpat to 2.6.2 (GH-117296) #118166
• [3.11] gh-116741: Upgrade libexpat to 2.6.2 (GH-117296) #118185
• [3.10] gh-116741: Upgrade libexpat to 2.6.2 (GH-117296) #118186
• [3.9] gh-116741: Upgrade libexpat to 2.6.2 (GH-117296) #118187
• [3.8] gh-116741: Upgrade libexpat to 2.6.2 (GH-117296) #118188

Activity

1. hartwork

   added

   type-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error

   on Mar 13, 2024
2. hartwork

   changed the title [-] Please upgrade bundled Expat to 2.6.2 (e.g. for the fix toCVE-2024-28757)[/-] [+] Please upgrade bundled Expat to 2.6.2 (e.g. for the fix to CVE-2024-28757)[/+] on Mar 13, 2024
3. hartwork commented on Mar 24, 2024

   

   hartwork

   on Mar 24, 2024

   ContributorAuthor

   More actions

   @sethmlarson any chance we could team up on this once more?
4. sethmlarson commented on Mar 27, 2024

   

   sethmlarson

   on Mar 27, 2024

   Contributor

   More actions

   @hartwork Sorry for not replying, I was gone for the past 2 weeks on vacation. Here's a PR upgrading 2.6.2, please take a look.
5. hartwork commented on Mar 27, 2024

   

   hartwork

   on Mar 27, 2024

   ContributorAuthor

   More actions

   @sethmlarson looks good, thank you! 👍
6. gpshead

   added a commit that references this issue on Apr 23, 2024

   gh-116741: Upgrade libexpat to 2.6.2 (#117296)

   c9829ee
7. miss-islington

   added a commit that references this issue on Apr 23, 2024

   pythongh-116741: Upgrade libexpat to 2.6.2 (pythonGH-117296)

   45e4357
8. gpshead

   added a commit that references this issue on Apr 23, 2024

   [3.12] gh-116741: Upgrade libexpat to 2.6.2 (GH-117296) (GH-118166)

   30725f0
9. sethmlarson

   added 4 commits that reference this issue on Apr 23, 2024

   [3.11] pythongh-116741: Upgrade libexpat to 2.6.2 (pythonGH-117296)

   672820f

   [3.10] pythongh-116741: Upgrade libexpat to 2.6.2 (pythonGH-117296)

   02e79dc

   [3.9] pythongh-116741: Upgrade libexpat to 2.6.2 (pythonGH-117296)

   2befdf2

   [3.8] pythongh-116741: Upgrade libexpat to 2.6.2 (pythonGH-117296)

   4ecde3b
10. gpshead

    added a commit that references this issue on Apr 23, 2024

    [3.11] gh-116741: Upgrade libexpat to 2.6.2 (GH-117296) (#118185)

    8133285
11. ambv

    added 3 commits that reference this issue on May 7, 2024

    [3.10] gh-116741: Upgrade libexpat to 2.6.2 (GH-117296) (GH-118186)

    2ec7018

    [3.9] gh-116741: Upgrade libexpat to 2.6.2 (GH-117296) (GH-118187)

    7db40cd

    [3.8] gh-116741: Upgrade libexpat to 2.6.2 (GH-117296) (GH-118188)

    f791cda
12. eli-schwartz commented on May 21, 2024

    

    eli-schwartz

    on May 21, 2024

    Contributor

    More actions

    Is this fully implemented now?
13. gpshead commented on May 21, 2024

    

    gpshead

    on May 21, 2024

    Member

    More actions

    it looks like all of the backports are in. yes.
14. gpshead

    closed this as completedon May 21, 2024

Issue actions