GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — gh-116741: Upgrade libexpat to 2.6.2 by sethmlarson · Pull Request #117296 · python/cpython

Conversation

@sethmlarson

@sethmlarson sethmlarson commented Mar 27, 2024 •
edited by bedevere-app Bot
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor

cc @hartwork

  • Issue: Please upgrade bundled Expat to 2.6.2 (e.g. for the fix to CVE-2024-28757) #116741

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@sethmlarson
Upgrade libexpat to 2.6.2
88969be
@sethmlarson sethmlarson added the type-security A security issue label Mar 27, 2024
@bedevere-app bedevere-app Bot added the awaiting review label Mar 27, 2024
@bedevere-app bedevere-app Bot mentioned this pull request Mar 27, 2024
Please upgrade bundled Expat to 2.6.2 (e.g. for the fix to CVE-2024-28757) #116741
Closed
hartwork
hartwork approved these changes Mar 27, 2024
View reviewed changes

@hartwork hartwork left a comment

Copy link
Copy Markdown
Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@sethmlarson looks good, my verification script likes it. Thank you! 👍

# Copyright (c) 2022-2024 Sebastian Pipping <[email protected]>
# Licensed under the Apache License version 2.0

FROM alpine
RUN apk add --update \
            diffutils \
            git \
            sed \
        && \
    git clone --depth 1 https://github.com/python/cpython cpython-main \
        && \
    ( cd cpython-main && git rev-parse HEAD ) \
        && \
    git clone --depth 1 --branch libexpat-2.6.2 https://github.com/sethmlarson/cpython cpython-pr \
        && \
    ( cd cpython-pr && git rev-parse HEAD ) \
        && \
    git config --global advice.detachedHead false \
        && \
    git clone --depth 1 --branch R_2_6_0 https://github.com/libexpat/libexpat libexpat_2_6_0 \
        && \
    git clone --depth 1 --branch R_2_6_2 https://github.com/libexpat/libexpat libexpat_2_6_2 \
        && \
    diff -r -u libexpat_2_6_0/expat/lib/ cpython-main/Modules/expat/ | tee 2-6-0.diff \
        && \
    diff -r -u libexpat_2_6_2/expat/lib/ cpython-pr/Modules/expat/ | tee 2-6-2.diff \
        && \
    sed -e '/^Only in /d' -e '/^\(+++\|---\) /d' -e '/^diff /d' -i 2-6-0.diff 2-6-2.diff \
        && \
    diff -u 2-6-0.diff 2-6-2.diff \
        && \
    echo 'Diff is good.'

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
gpshead reacted with thumbs up emoji
All reactions
  • 👍 1 reaction
@bedevere-app bedevere-app Bot added awaiting core review and removed awaiting review labels Mar 27, 2024
@hartwork

hartwork commented Apr 14, 2024

Copy link
Copy Markdown
Contributor

@sethmlarson ready to merge?
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@hartwork

hartwork commented Apr 22, 2024

Copy link
Copy Markdown
Contributor

@sethmlarson any news?
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@sethmlarson

sethmlarson commented Apr 22, 2024

Copy link
Copy Markdown
Contributor Author

@hartwork I can't merge PRs on my own, I'll find a core developer to merge.
hartwork and gpshead reacted with thumbs up emoji
All reactions
  • 👍 2 reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
gpshead
gpshead approved these changes Apr 23, 2024
View reviewed changes

@gpshead gpshead left a comment

Copy link
Copy Markdown
Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These changes appear to match libexpat/libexpat@R_2_6_0...R_2_6_2.

We should probably script updating this.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@bedevere-app bedevere-app Bot added awaiting merge and removed awaiting core review labels Apr 23, 2024
@gpshead gpshead added needs backport to 3.8 needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes labels Apr 23, 2024
@gpshead
gpshead merged commit c9829ee into python:main Apr 23, 2024
@miss-islington-app

miss-islington-app Bot commented Apr 23, 2024

Copy link
Copy Markdown

Thanks @sethmlarson for the PR, and @gpshead for merging it 🌮🎉.. I'm working now to backport this PR to: 3.8, 3.9, 3.10, 3.11, 3.12.
🐍🍒⛏🤖
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the awaiting merge label Apr 23, 2024
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Apr 23, 2024
@sethmlarson @miss-islington
pythongh-116741: Upgrade libexpat to 2.6.2 (pythonGH-117296)
45e4357 
Upgrade libexpat to 2.6.2
(cherry picked from commit c9829ee)

Co-authored-by: Seth Michael Larson <[email protected]>
@miss-islington-app

miss-islington-app Bot commented Apr 23, 2024

Copy link
Copy Markdown

Sorry, @sethmlarson and @gpshead, I could not cleanly backport this to 3.11 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker c9829eec0883a8991ea4d319d965e123a3cf6c20 3.11
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@miss-islington-app miss-islington-app Bot assigned gpshead Apr 23, 2024
@bedevere-app

bedevere-app Bot commented Apr 23, 2024

Copy link
Copy Markdown

GH-118166 is a backport of this pull request to the 3.12 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.12 only security fixes label Apr 23, 2024
@miss-islington-app

miss-islington-app Bot commented Apr 23, 2024

Copy link
Copy Markdown

Sorry, @sethmlarson and @gpshead, I could not cleanly backport this to 3.10 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker c9829eec0883a8991ea4d319d965e123a3cf6c20 3.10
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@miss-islington-app

miss-islington-app Bot commented Apr 23, 2024

Copy link
Copy Markdown

Sorry, @sethmlarson and @gpshead, I could not cleanly backport this to 3.9 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker c9829eec0883a8991ea4d319d965e123a3cf6c20 3.9
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@miss-islington-app

miss-islington-app Bot commented Apr 23, 2024

Copy link
Copy Markdown

Sorry, @sethmlarson and @gpshead, I could not cleanly backport this to 3.8 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker c9829eec0883a8991ea4d319d965e123a3cf6c20 3.8
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
gpshead pushed a commit that referenced this pull request Apr 23, 2024
@miss-islington @sethmlarson
[3.12] gh-116741: Upgrade libexpat to 2.6.2 (GH-117296) (GH-118166)
30725f0 
gh-116741: Upgrade libexpat to 2.6.2 (GH-117296)

Upgrade libexpat to 2.6.2
(cherry picked from commit c9829ee)

Co-authored-by: Seth Michael Larson <[email protected]>
@sethmlarson
sethmlarson deleted the libexpat-2.6.2 branch April 23, 2024 16:59
@bedevere-app

bedevere-app Bot commented Apr 23, 2024

Copy link
Copy Markdown

GH-118185 is a backport of this pull request to the 3.11 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.11 only security fixes label Apr 23, 2024
sethmlarson added a commit to sethmlarson/cpython that referenced this pull request Apr 23, 2024
@sethmlarson
[3.11] pythongh-116741: Upgrade libexpat to 2.6.2 (pythonGH-117296)
672820f 
Upgrade libexpat to 2.6.2
(cherry picked from commit c9829ee)

Co-authored-by: Seth Michael Larson <[email protected]>
sethmlarson added a commit to sethmlarson/cpython that referenced this pull request Apr 23, 2024
@sethmlarson
[3.10] pythongh-116741: Upgrade libexpat to 2.6.2 (pythonGH-117296)
02e79dc 
Upgrade libexpat to 2.6.2
(cherry picked from commit c9829ee)

Co-authored-by: Seth Michael Larson <[email protected]>
@bedevere-app

bedevere-app Bot commented Apr 23, 2024

Copy link
Copy Markdown

GH-118186 is a backport of this pull request to the 3.10 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.10 label Apr 23, 2024
sethmlarson added a commit to sethmlarson/cpython that referenced this pull request Apr 23, 2024
@sethmlarson
[3.9] pythongh-116741: Upgrade libexpat to 2.6.2 (pythonGH-117296)
2befdf2 
Upgrade libexpat to 2.6.2
(cherry picked from commit c9829ee)

Co-authored-by: Seth Michael Larson <[email protected]>
@bedevere-app

bedevere-app Bot commented Apr 23, 2024

Copy link
Copy Markdown

GH-118187 is a backport of this pull request to the 3.9 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.9 label Apr 23, 2024
sethmlarson added a commit to sethmlarson/cpython that referenced this pull request Apr 23, 2024
@sethmlarson
[3.8] pythongh-116741: Upgrade libexpat to 2.6.2 (pythonGH-117296)
4ecde3b 
Upgrade libexpat to 2.6.2
(cherry picked from commit c9829ee)

Co-authored-by: Seth Michael Larson <[email protected]>
@bedevere-app

bedevere-app Bot commented Apr 23, 2024

Copy link
Copy Markdown

GH-118188 is a backport of this pull request to the 3.8 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.8 label Apr 23, 2024
@sethmlarson

sethmlarson commented Apr 23, 2024

Copy link
Copy Markdown
Contributor Author

Created the backports:

  • [3.11] gh-116741: Upgrade libexpat to 2.6.2 (GH-117296) #118185
  • [3.10] gh-116741: Upgrade libexpat to 2.6.2 (GH-117296) #118186
  • [3.9] gh-116741: Upgrade libexpat to 2.6.2 (GH-117296) #118187
  • [3.8] gh-116741: Upgrade libexpat to 2.6.2 (GH-117296) #118188
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@hartwork

hartwork commented Apr 23, 2024

Copy link
Copy Markdown
Contributor

@sethmlarson thanks a lot! 👍
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
gpshead pushed a commit that referenced this pull request Apr 23, 2024
@sethmlarson
[3.11] gh-116741: Upgrade libexpat to 2.6.2 (GH-117296) (#118185)
8133285 
Upgrade libexpat to 2.6.2
(cherry picked from commit c9829ee)
@bedevere-bot

bedevere-bot commented Apr 23, 2024

Copy link
Copy Markdown

⚠️⚠️⚠️ Buildbot failure ⚠️⚠️⚠️

Hi! The buildbot AMD64 RHEL8 FIPS Only Blake2 Builtin Hash 3.11 has failed when building commit 8133285.

What do you need to do:

  1. Don't panic.
  2. Check the buildbot page in the devguide if you don't know what the buildbots are or how they work.
  3. Go to the page of the buildbot that failed (https://buildbot.python.org/all/#builders/962/builds/1513) and take a look at the build logs.
  4. Check if the failure is related to this commit (8133285) or if it is a false positive.
  5. If the failure is related to this commit, please, reflect that on the issue and make a new Pull Request with a fix.

You can take a look at the buildbot page here:

https://buildbot.python.org/all/#builders/962/builds/1513

Failed tests:

  • test.test_multiprocessing_spawn.test_processes
  • test.test_multiprocessing_fork.test_processes
  • test.test_multiprocessing_forkserver.test_processes

Failed subtests:

  • test_empty_authkey - test.test_multiprocessing_forkserver.test_processes.WithProcessesTestListener.test_empty_authkey
  • test_empty_authkey - test.test_multiprocessing_fork.test_processes.WithProcessesTestListener.test_empty_authkey
  • test_empty_authkey - test.test_multiprocessing_spawn.test_processes.WithProcessesTestListener.test_empty_authkey

Summary of the results of the build (if available):

==

Click to see traceback logs 
Traceback (most recent call last):
  File "/home/buildbot/buildarea/3.11.cstratak-RHEL8-fips-x86_64.no-builtin-hashes-except-blake2/build/Lib/test/_test_multiprocessing.py", line 3483, in test_empty_authkey
    with listener.accept() as d:
         ^^^^^^^^^^^^^^^^^
  File "/home/buildbot/buildarea/3.11.cstratak-RHEL8-fips-x86_64.no-builtin-hashes-except-blake2/build/Lib/multiprocessing/connection.py", line 482, in accept
    deliver_challenge(c, self._authkey)
  File "/home/buildbot/buildarea/3.11.cstratak-RHEL8-fips-x86_64.no-builtin-hashes-except-blake2/build/Lib/multiprocessing/connection.py", line 756, in deliver_challenge
    digest = hmac.new(authkey, message, 'md5').digest()
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/buildbot/buildarea/3.11.cstratak-RHEL8-fips-x86_64.no-builtin-hashes-except-blake2/build/Lib/hmac.py", line 184, in new
    return HMAC(key, msg, digestmod)
           ^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/buildbot/buildarea/3.11.cstratak-RHEL8-fips-x86_64.no-builtin-hashes-except-blake2/build/Lib/hmac.py", line 60, in __init__
    self._init_hmac(key, msg, digestmod)
  File "/home/buildbot/buildarea/3.11.cstratak-RHEL8-fips-x86_64.no-builtin-hashes-except-blake2/build/Lib/hmac.py", line 67, in _init_hmac
    self._hmac = _hashopenssl.hmac_new(key, msg, digestmod=digestmod)
                 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
ValueError: no reason supplied


Traceback (most recent call last):
  File "/home/buildbot/buildarea/3.11.cstratak-RHEL8-fips-x86_64.no-builtin-hashes-except-blake2/build/Lib/threading.py", line 1045, in _bootstrap_inner
    self.run()
  File "/home/buildbot/buildarea/3.11.cstratak-RHEL8-fips-x86_64.no-builtin-hashes-except-blake2/build/Lib/threading.py", line 982, in run
    self._target(*self._args, **self._kwargs)
  File "/home/buildbot/buildarea/3.11.cstratak-RHEL8-fips-x86_64.no-builtin-hashes-except-blake2/build/Lib/test/_test_multiprocessing.py", line 3474, in run
    client = self.connection.Client(addr, authkey=authkey)
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/buildbot/buildarea/3.11.cstratak-RHEL8-fips-x86_64.no-builtin-hashes-except-blake2/build/Lib/multiprocessing/connection.py", line 525, in Client
    answer_challenge(c, authkey)
  File "/home/buildbot/buildarea/3.11.cstratak-RHEL8-fips-x86_64.no-builtin-hashes-except-blake2/build/Lib/multiprocessing/connection.py", line 772, in answer_challenge
    digest = hmac.new(authkey, message, 'md5').digest()
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/buildbot/buildarea/3.11.cstratak-RHEL8-fips-x86_64.no-builtin-hashes-except-blake2/build/Lib/hmac.py", line 184, in new
    return HMAC(key, msg, digestmod)
           ^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/buildbot/buildarea/3.11.cstratak-RHEL8-fips-x86_64.no-builtin-hashes-except-blake2/build/Lib/hmac.py", line 60, in __init__
    self._init_hmac(key, msg, digestmod)
  File "/home/buildbot/buildarea/3.11.cstratak-RHEL8-fips-x86_64.no-builtin-hashes-except-blake2/build/Lib/hmac.py", line 67, in _init_hmac
    self._hmac = _hashopenssl.hmac_new(key, msg, digestmod=digestmod)
                 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
ValueError: no reason supplied
ERROR
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
ambv pushed a commit that referenced this pull request May 7, 2024
@sethmlarson
[3.10] gh-116741: Upgrade libexpat to 2.6.2 (GH-117296) (GH-118186)
2ec7018 
(cherry picked from commit c9829ee)
ambv pushed a commit that referenced this pull request May 7, 2024
@sethmlarson
[3.9] gh-116741: Upgrade libexpat to 2.6.2 (GH-117296) (GH-118187)
7db40cd 
(cherry picked from commit c9829ee)
ambv pushed a commit that referenced this pull request May 7, 2024
@sethmlarson
[3.8] gh-116741: Upgrade libexpat to 2.6.2 (GH-117296) (GH-118188)
f791cda 
(cherry picked from commit c9829ee)
@hartwork hartwork mentioned this pull request Sep 4, 2024
Please upgrade bundled Expat to 2.6.3 (e.g. for the fixes to CVE-2024-45490, CVE-2024-45491 and CVE-2024-45492) #123678
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@gpshead gpshead gpshead approved these changes
+1 more reviewer
@hartwork hartwork hartwork approved these changes
Reviewers whose approvals may not affect merge requirements

Uh oh!

There was an error while loading. Please reload this page.

Assignees

@gpshead gpshead

Labels

type-security A security issue

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

4 participants

@sethmlarson @hartwork @bedevere-bot @gpshead
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.