Description

hartwork

opened on Sep 4, 2024

Issue body actions

Bug report

Bug description:

Hi! 👋

Please upgrade bundled Expat to 2.6.3 (e.g. for the fixes to CVE-2024-45490, CVE-2024-45491 and CVE-2024-45492).

• GitHub release: https://github.com/libexpat/libexpat/releases/tag/R_2_6_3
• Change log: https://github.com/libexpat/libexpat/blob/R_2_6_3/expat/Changes

The CPython issue for previous 2.6.2 was #116741 and the related merged main pull request was #117296, in case you want to have a look. The Dockerfile from comment #117296 (review) could be of help with raising confidence in a bump pull request when going forward.

Thanks in advance!

CPython versions tested on:

3.8, 3.9, 3.10, 3.11, 3.12, 3.13, CPython main branch

Operating systems tested on:

Linux, macOS, Windows, Other

Linked PRs

• gh-123678: Upgrade libexpat 2.6.3 #123689
• [3.13] gh-123678: Upgrade libexpat 2.6.3 #123705
• [3.12] gh-123678: Upgrade libexpat 2.6.3 #123706
• [3.13] gh-123678: Upgrade libexpat 2.6.3 (GH-123689) #123707
• [3.12] gh-123678: Upgrade libexpat 2.6.3 (GH-123689) #123708
• [3.11] gh-123678: Upgrade libexpat 2.6.3 #123709
• [3.10] gh-123678: Upgrade libexpat 2.6.3 #123710
• [3.9] gh-123678: Upgrade libexpat 2.6.3 #123711
• [3.8] gh-123678: Upgrade libexpat 2.6.3 #123712

Reacted by Łukasz Langa and Kirill Podoprigora

Activity

1. hartwork

   added

   type-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error

   on Sep 4, 2024
2. Eclips4

   added

   type-securityA security issueA security issue

   on Sep 4, 2024
3. sobolevn commented on Sep 4, 2024

   

   sobolevn

   on Sep 4, 2024

   Member

   More actions

   cc @sethmlarson
4. sethmlarson commented on Sep 4, 2024

   

   sethmlarson

   on Sep 4, 2024

   Contributor

   More actions

   Thanks for the ping @sobolevn, I'll work with release managers to get this update out.

   Reacted by sobolevn, Sebastian Pipping and Kirill Podoprigora

   Reacted by Łukasz Langa
5. sethmlarson commented on Sep 4, 2024

   

   sethmlarson

   on Sep 4, 2024

   Contributor

   More actions

   I've created a PR, please take a look: #123689

   Reacted by Sebastian Pipping
6. gpshead

   added a commit that references this issue on Sep 4, 2024

   gh-123678: Upgrade libexpat 2.6.3 (#123689)

   40bdb0d
7. miss-islington

   added 2 commits that reference this issue on Sep 4, 2024

   pythongh-123678: Upgrade libexpat 2.6.3 (pythonGH-123689)

   054b5b6

   pythongh-123678: Upgrade libexpat 2.6.3 (pythonGH-123689)

   3c290df
8. sethmlarson

   self-assigned this

   on Sep 4, 2024
9. gpshead

   added a commit that references this issue on Sep 4, 2024

   [3.12] gh-123678: Upgrade libexpat 2.6.3 (GH-123689) (GH-123708)

   3cf7d33
10. encukou

    added a commit that references this issue on Sep 5, 2024

    [3.13] gh-123678: Upgrade libexpat 2.6.3 (GH-123689) (GH-123707)

    9810dfa
11. ambv

    added 4 commits that reference this issue on Sep 5, 2024

    [3.11] gh-123678: Upgrade libexpat 2.6.3 (#123709)

    b582d52

    [3.10] gh-123678: Upgrade libexpat 2.6.3 (#123710)

    0e006ce

    [3.9] gh-123678: Upgrade libexpat 2.6.3 (#123711)

    c57c4a9

    [3.8] gh-123678: Upgrade libexpat 2.6.3 (#123712)

    a50a86d
12. sethmlarson commented on Sep 5, 2024

    

    sethmlarson

    on Sep 5, 2024

    Contributor

    More actions

    All pull requests have been merged

    Reacted by Sebastian Pipping
13. sethmlarson

    closed this as completedon Sep 5, 2024

Issue actions