Description

hartwork

opened on Mar 14, 2025

Issue body actions

Bug report

Bug description:

Hi! 👋

Please upgrade bundled Expat to 2.7.0 (e.g. for the fix to CVE-2024-8176).

• GitHub release: https://github.com/libexpat/libexpat/releases/tag/R_2_7_0
• Change log: https://github.com/libexpat/libexpat/blob/R_2_7_0/expat/Changes
• Bonus: Blog post Recursion kills: The story behind CVE-2024-8176 in libexpat

The CPython issue for previous 2.6.4 was #126623 and the related merged main pull request was #126792, in case you want to have a look. The Dockerfile from comment #123689 (review) could be of help with raising confidence in a bump pull request when going forward.

Thanks in advance!

CC @sethmlarson @gpshead

CPython versions tested on:

3.9, 3.10, 3.11, 3.12, 3.13, 3.14, CPython main branch

Operating systems tested on:

Linux, macOS, Windows, Other

Linked PRs

• gh-131261: Update libexpat to 2.7.0 (CVE-2024-8176) #131272
• gh-131261: expat/refresh.sh: Expand list of manual steps #131359
• [3.13] gh-131261: Update libexpat to 2.7.0 (CVE-2024-8176) (GH-131272) #131360
• [3.12] gh-131261: Update libexpat to 2.7.0 (CVE-2024-8176) #131361
• [3.11] gh-131261: Update libexpat to 2.7.0 (CVE-2024-8176) (GH-131272) #131362
• [3.10] gh-131261: Update libexpat to 2.7.0 (CVE-2024-8176) (GH-131272) #131363
• [3.9] gh-131261: Update libexpat to 2.7.0 (CVE-2024-8176) (GH-131272) #131364
• [3.13] gh-131261: generate_sbom.py: Exclude the refresh script from SBOM (GH-131359) #144625
• [3.12] gh-131261: generate_sbom.py: Exclude the refresh script from SBOM (GH-131359) (GH-144625) #144660

Reacted by Gregory P. Smith

Activity

1. hartwork

   added

   type-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error

   on Mar 14, 2025
2. picnixz

   added

   topic-XML

   type-securityA security issueA security issue

   3.11only security fixesonly security fixes

   3.10 (EOL)end of lifeend of life

   3.9 (EOL)end of lifeend of life

   3.12only security fixesonly security fixes

   3.13only security fixesonly security fixes

   3.14bugs and security fixesbugs and security fixes

   extension-modulesC modules in the Modules dirC modules in the Modules dir

   and removed

   type-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error

   on Mar 14, 2025
3. gpshead

   added

   release-blocker

   on Mar 15, 2025
4. ezio-melotti

   added this to Release and Deferred blockers 🚫on Mar 15, 2025
5. github-project-automation

   moved this to Todo in Release and Deferred blockers 🚫on Mar 15, 2025
6. gpshead

   assigned

   sethmlarson

   on Mar 15, 2025
7. 12 remaining items

8. gpshead commented on Mar 18, 2025

   

   gpshead

   on Mar 18, 2025

   Member

   More actions

   For those watching: chatting with @sethmlarson, we decided this one is not worth expedited security releases on. this should land in our next regularly scheduled releases seen in https://peps.python.org/topic/release/.

   Reacted by Seth Larson and vEpiphyte
9. hartwork commented on Mar 18, 2025

   

   hartwork

   on Mar 18, 2025

   ContributorAuthor

   More actions

   Thanks for updating and sharing that info! 👍
10. colesbury

    added a commit that references this issue on Mar 20, 2025

    pythongh-131261: expat/refresh.sh: Expand list of manual steps (pytho…

    95fc905
11. pablogsal

    added a commit that references this issue on Apr 1, 2025

    [3.10] gh-131261: Update libexpat to 2.7.0 (CVE-2024-8176) (GH-131272) (

    b22e607
12. ambv

    added 2 commits that reference this issue on Apr 3, 2025

    [3.11] gh-131261: Update libexpat to 2.7.0 (CVE-2024-8176) (GH-131272) (

    ba49eab

    [3.9] gh-131261: Update libexpat to 2.7.0 (CVE-2024-8176) (GH-131272) (…

    8ad2d88
13. hugovk commented on Apr 7, 2025

    

    hugovk

    on Apr 7, 2025

    Member

    More actions

    2.7.0 is merged and backported, see #131809 / #132192 for 2.7.1.
14. hugovk

    closed this as completedon Apr 7, 2025
15. github-project-automation

    moved this from In Progress to Done in Release and Deferred blockers 🚫on Apr 7, 2025
16. encukou

    added 4 commits that reference this issue on Feb 5, 2026

    pythongh-131261: expat/refresh.sh: Expand list of manual steps (pytho…

    dc73ce3

    pythongh-131261: expat/refresh.sh: Expand list of manual steps (pytho…

    ae29b0d

    [3.13] pythongh-131261: expat/refresh.sh: Expand list of manual steps (…

    988ea75

    [3.13] gh-131261: generate_sbom.py: Exclude the refresh script from S…

    bad4bc4
17. miss-islington

    added a commit that references this issue on Feb 10, 2026

    [3.13] pythongh-131261: generate_sbom.py: Exclude the refresh script …

    7b7483b
18. encukou

    added a commit that references this issue on Feb 10, 2026

    Revert "pythongh-131261: expat/refresh.sh: Expand list of manual steps (

    f3aaef0

Issue actions