GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — gh-115399: Document CVE-2023-52425 under "XML vulnerabilities" by hartwork · Pull Request #115400 · python/cpython

Conversation

@hartwork

@hartwork hartwork commented Feb 13, 2024 •
edited by bedevere-app Bot
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor

Loosely related to #115399

A dedicated issue didn't seem needed here, but I can create one, if you consider it needed.

📚 Documentation preview 📚: https://cpython-previews--115400.org.readthedocs.build/

  • Issue: Please upgrade bundled Expat to 2.6.0 (e.g. for the fix to CVE-2023-52425) #115399

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@bedevere-app bedevere-app Bot added awaiting review docs Documentation in the Doc dir labels Feb 13, 2024
@hartwork hartwork mentioned this pull request Feb 14, 2024
Release Expat 2.6.0 libexpat/libexpat#775
Closed
28 tasks done
@sethmlarson sethmlarson added needs backport to 3.8 needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes labels Feb 14, 2024
@sethmlarson

sethmlarson commented Feb 14, 2024

Copy link
Copy Markdown
Contributor

@hartwork Looks like CI is failing, the news fragment name appears to not be the correct format?

@ambv I'm not sure if docs changes like this get backported to security-only branches?
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@hartwork

hartwork commented Feb 14, 2024 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor Author

@hartwork Looks like CI is failing, the news fragment name appears to not be the correct format?

@sethmlarson yes, I I wish I knew what the correct file naming is for when there is no GitHub issue, that case seems to be undocumented or hard to find. Any ideas how to rename the file or where to find the related blurp docs? Googling for e.g. "blurp without github issue" doesn't get me anyhere.

@ambv I'm not sure if docs changes like this get backported to security-only branches?

If I may add: this docs extension is security related. Please take my vote for backporting to security-only branches (unless I am missing good reasons not to). If it ends up producing merge conflicts, I can see if I can help with resolving them if reasonably economic. Thanks!
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@sethmlarson

sethmlarson commented Feb 14, 2024

Copy link
Copy Markdown
Contributor

@hartwork The tool is "blurb" I think, also you can use #115399 for the GitHub issue.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@hartwork

hartwork commented Feb 14, 2024

Copy link
Copy Markdown
Contributor Author

you can use #115399 for the GitHub issue.

@sethmlarson good idea, give me a second…
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@hartwork
Doc/library/xml.rst: Document CVE-2023-52425 under "XML vulnerabilities"
3021d11
@hartwork
hartwork force-pushed the document-cve-2023-52425-under-xml-vulnerabilities branch from 0b5365b to 3021d11 Compare February 14, 2024 19:17
@hartwork hartwork changed the title Doc/library/xml.rst: Document CVE-2023-52425 under "XML vulnerabilities" gh-115399: Document CVE-2023-52425 under "XML vulnerabilities" Feb 14, 2024
@bedevere-app bedevere-app Bot mentioned this pull request Feb 14, 2024
Please upgrade bundled Expat to 2.6.0 (e.g. for the fix to CVE-2023-52425) #115399
Closed
@ambv
ambv merged commit fbd40ce into python:main Feb 21, 2024
@bedevere-app bedevere-app Bot removed the awaiting review label Feb 21, 2024
@miss-islington-app

miss-islington-app Bot commented Feb 21, 2024

Copy link
Copy Markdown

Thanks @hartwork for the PR, and @ambv for merging it 🌮🎉.. I'm working now to backport this PR to: 3.8, 3.9, 3.10, 3.11, 3.12.
🐍🍒⛏🤖
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Feb 21, 2024
@hartwork @miss-islington
pythongh-115399: Document CVE-2023-52425 under "XML vulnerabilities" (p…
0873ae7 
…ythonGH-115400)

Doc/library/xml.rst: Document CVE-2023-52425 under "XML vulnerabilities"
(cherry picked from commit fbd40ce)

Co-authored-by: Sebastian Pipping <[email protected]>
@bedevere-app

bedevere-app Bot commented Feb 21, 2024

Copy link
Copy Markdown

GH-115760 is a backport of this pull request to the 3.12 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.12 only security fixes label Feb 21, 2024
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Feb 21, 2024
@hartwork @miss-islington
pythongh-115399: Document CVE-2023-52425 under "XML vulnerabilities" (p…
d80a4cf 
…ythonGH-115400)

Doc/library/xml.rst: Document CVE-2023-52425 under "XML vulnerabilities"
(cherry picked from commit fbd40ce)

Co-authored-by: Sebastian Pipping <[email protected]>
@bedevere-app

bedevere-app Bot commented Feb 21, 2024

Copy link
Copy Markdown

GH-115761 is a backport of this pull request to the 3.11 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.11 only security fixes label Feb 21, 2024
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Feb 21, 2024
@hartwork @miss-islington
pythongh-115399: Document CVE-2023-52425 under "XML vulnerabilities" (p…
af23c8c 
…ythonGH-115400)

Doc/library/xml.rst: Document CVE-2023-52425 under "XML vulnerabilities"
(cherry picked from commit fbd40ce)

Co-authored-by: Sebastian Pipping <[email protected]>
@bedevere-app

bedevere-app Bot commented Feb 21, 2024

Copy link
Copy Markdown

GH-115762 is a backport of this pull request to the 3.10 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.10 label Feb 21, 2024
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Feb 21, 2024
@hartwork @miss-islington
pythongh-115399: Document CVE-2023-52425 under "XML vulnerabilities" (p…
d5fd04b 
…ythonGH-115400)

Doc/library/xml.rst: Document CVE-2023-52425 under "XML vulnerabilities"
(cherry picked from commit fbd40ce)

Co-authored-by: Sebastian Pipping <[email protected]>
@bedevere-app

bedevere-app Bot commented Feb 21, 2024

Copy link
Copy Markdown

GH-115763 is a backport of this pull request to the 3.9 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.9 label Feb 21, 2024
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Feb 21, 2024
@hartwork @miss-islington
pythongh-115399: Document CVE-2023-52425 under "XML vulnerabilities" (p…
bd8c826 
…ythonGH-115400)

Doc/library/xml.rst: Document CVE-2023-52425 under "XML vulnerabilities"
(cherry picked from commit fbd40ce)

Co-authored-by: Sebastian Pipping <[email protected]>
@bedevere-app

bedevere-app Bot commented Feb 21, 2024

Copy link
Copy Markdown

GH-115764 is a backport of this pull request to the 3.8 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.8 label Feb 21, 2024
ambv pushed a commit that referenced this pull request Feb 21, 2024
@miss-islington @hartwork
[3.12] gh-115399: Document CVE-2023-52425 under "XML vulnerabilities" (…
cab8d07 
…GH-115400) (GH-115760)

Doc/library/xml.rst: Document CVE-2023-52425 under "XML vulnerabilities"
(cherry picked from commit fbd40ce)

Co-authored-by: Sebastian Pipping <[email protected]>
ambv pushed a commit that referenced this pull request Feb 21, 2024
@miss-islington @hartwork
[3.11] gh-115399: Document CVE-2023-52425 under "XML vulnerabilities" (…
6928d5e 
…GH-115400) (GH-115761)

Doc/library/xml.rst: Document CVE-2023-52425 under "XML vulnerabilities"
(cherry picked from commit fbd40ce)

Co-authored-by: Sebastian Pipping <[email protected]>
ambv pushed a commit that referenced this pull request Feb 21, 2024
@miss-islington @hartwork
[3.10] gh-115399: Document CVE-2023-52425 under "XML vulnerabilities" (…
b612ec6 
…GH-115400) (GH-115762)

Doc/library/xml.rst: Document CVE-2023-52425 under "XML vulnerabilities"
(cherry picked from commit fbd40ce)

Co-authored-by: Sebastian Pipping <[email protected]>
ambv pushed a commit that referenced this pull request Feb 21, 2024
@miss-islington @hartwork
[3.8] gh-115399: Document CVE-2023-52425 under "XML vulnerabilities" (G…
1e7f79a 
…H-115400) (GH-115764)

Doc/library/xml.rst: Document CVE-2023-52425 under "XML vulnerabilities"
(cherry picked from commit fbd40ce)

Co-authored-by: Sebastian Pipping <[email protected]>
ambv pushed a commit that referenced this pull request Feb 21, 2024
@miss-islington @hartwork
[3.9] gh-115399: Document CVE-2023-52425 under "XML vulnerabilities" (G…
0397866 
…H-115400) (GH-115763)

Doc/library/xml.rst: Document CVE-2023-52425 under "XML vulnerabilities"
(cherry picked from commit fbd40ce)

Co-authored-by: Sebastian Pipping <[email protected]>
woodruffw pushed a commit to woodruffw-forks/cpython that referenced this pull request Mar 4, 2024
@hartwork @woodruffw
pythongh-115399: Document CVE-2023-52425 under "XML vulnerabilities" (p…
1aae53b 
…ythonGH-115400)

Doc/library/xml.rst: Document CVE-2023-52425 under "XML vulnerabilities"
diegorusso pushed a commit to diegorusso/cpython that referenced this pull request Apr 17, 2024
@hartwork @diegorusso
pythongh-115399: Document CVE-2023-52425 under "XML vulnerabilities" (p…
46450e5 
…ythonGH-115400)

Doc/library/xml.rst: Document CVE-2023-52425 under "XML vulnerabilities"
LukasWoodtli pushed a commit to LukasWoodtli/cpython that referenced this pull request Jan 22, 2025
@hartwork @LukasWoodtli
pythongh-115399: Document CVE-2023-52425 under "XML vulnerabilities" (p…
5f85da6 
…ythonGH-115400)

Doc/library/xml.rst: Document CVE-2023-52425 under "XML vulnerabilities"
@hartwork hartwork mentioned this pull request Sep 23, 2025
gh-90949: add Expat API to prevent XML deadly allocations #139234
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

docs Documentation in the Doc dir

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

3 participants

@hartwork @sethmlarson @ambv
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.