GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — gh-123678: Upgrade libexpat 2.6.3 by sethmlarson · Pull Request #123689 · python/cpython

Conversation

@sethmlarson

@sethmlarson sethmlarson commented Sep 4, 2024 •
edited by bedevere-app Bot
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor
  • Issue: Please upgrade bundled Expat to 2.6.3 (e.g. for the fixes to CVE-2024-45490, CVE-2024-45491 and CVE-2024-45492) #123678

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions
@bedevere-app bedevere-app Bot added the awaiting review label Sep 4, 2024
@sethmlarson sethmlarson mentioned this pull request Sep 4, 2024
Please upgrade bundled Expat to 2.6.3 (e.g. for the fixes to CVE-2024-45490, CVE-2024-45491 and CVE-2024-45492) #123678
Closed
@sethmlarson sethmlarson added the type-security A security issue label Sep 4, 2024
@sethmlarson
Upgrade libexpat 2.6.3
e6fe0ac
@sethmlarson
sethmlarson force-pushed the expat-2.6.3 branch from 3dfa06c to e6fe0ac Compare September 4, 2024 17:52
hartwork
hartwork approved these changes Sep 4, 2024
View reviewed changes

@hartwork hartwork left a comment

Copy link
Copy Markdown
Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@sethmlarson verified using the Dockerfile below 👍

# Copyright (c) 2022-2024 Sebastian Pipping <[email protected]>
# Licensed under the Apache License version 2.0

FROM alpine
RUN apk add --update \
            diffutils \
            git \
            sed \
        && \
    git clone --depth 1 https://github.com/python/cpython cpython-main \
        && \
    ( cd cpython-main && git rev-parse HEAD ) \
        && \
    git clone --depth 1 --branch expat-2.6.3 https://github.com/sethmlarson/cpython cpython-pr \
        && \
    ( cd cpython-pr && git rev-parse HEAD ) \
        && \
    git config --global advice.detachedHead false \
        && \
    git clone --depth 1 --branch R_2_6_2 https://github.com/libexpat/libexpat libexpat_2_6_2 \
        && \
    git clone --depth 1 --branch R_2_6_3 https://github.com/libexpat/libexpat libexpat_2_6_3 \
        && \
    diff -r -u libexpat_2_6_2/expat/lib/ cpython-main/Modules/expat/ | tee 2-6-2.diff \
        && \
    diff -r -u libexpat_2_6_3/expat/lib/ cpython-pr/Modules/expat/ | tee 2-6-3.diff \
        && \
    sed -e '/^Only in /d' -e '/^\(+++\|---\) /d' -e '/^diff /d' -i 2-6-2.diff 2-6-3.diff \
        && \
    diff -u 2-6-2.diff 2-6-3.diff \
        && \
    echo 'Diff is good.'
# docker build .
DEPRECATED: The legacy builder is deprecated and will be removed in a future release.
            Install the buildx component to build images with BuildKit:
            https://docs.docker.com/go/buildx/

Sending build context to Docker daemon  3.072kB
Step 1/2 : FROM alpine
 ---> 05455a08881e
Step 2/2 : RUN apk add --update             diffutils             git             sed         &&     git clone --depth 1 https://github.com/python/cpython cpython-main         &&     ( cd cpython-main && git rev-parse HEAD )         &&     git clone --depth 1 --branch expat-2.6.3 https://github.com/sethmlarson/cpython cpython-pr         &&     ( cd cpython-pr && git rev-parse HEAD )         &&     git config --global advice.detachedHead false         &&     git clone --depth 1 --branch R_2_6_2 https://github.com/libexpat/libexpat libexpat_2_6_2         &&     git clone --depth 1 --branch R_2_6_3 https://github.com/libexpat/libexpat libexpat_2_6_3         &&     diff -r -u libexpat_2_6_2/expat/lib/ cpython-main/Modules/expat/ | tee 2-6-2.diff         &&     diff -r -u libexpat_2_6_3/expat/lib/ cpython-pr/Modules/expat/ | tee 2-6-3.diff         &&     sed -e '/^Only in /d' -e '/^\(+++\|---\) /d' -e '/^diff /d' -i 2-6-2.diff 2-6-3.diff         &&     diff -u 2-6-2.diff 2-6-3.diff         &&     echo 'Diff is good.'
 ---> Running in 03fb2eed1a29
fetch https://dl-cdn.alpinelinux.org/alpine/v3.19/main/x86_64/APKINDEX.tar.gz
fetch https://dl-cdn.alpinelinux.org/alpine/v3.19/community/x86_64/APKINDEX.tar.gz
(1/12) Installing diffutils (3.10-r0)
(2/12) Installing ca-certificates (20240226-r0)
(3/12) Installing brotli-libs (1.1.0-r1)
(4/12) Installing c-ares (1.27.0-r0)
(5/12) Installing libunistring (1.1-r2)
(6/12) Installing libidn2 (2.3.4-r4)
(7/12) Installing nghttp2-libs (1.58.0-r0)
(8/12) Installing libcurl (8.9.0-r0)
(9/12) Installing libexpat (2.6.2-r0)
(10/12) Installing pcre2 (10.42-r2)
(11/12) Installing git (2.43.4-r0)
(12/12) Installing sed (4.9-r2)
Executing busybox-1.36.1-r15.trigger
Executing ca-certificates-20240226-r0.trigger
OK: 19 MiB in 27 packages
Cloning into 'cpython-main'...
Updating files: 100% (5350/5350), done.
d2eafe2f48aac31aa8a152620bdfd0f2a274ee1d
Cloning into 'cpython-pr'...
Updating files: 100% (5350/5350), done.
e6fe0ac014e8f5b17064c20d1ae937dbd4c761a2
Cloning into 'libexpat_2_6_2'...
Cloning into 'libexpat_2_6_3'...
Only in libexpat_2_6_2/expat/lib/: .gitignore
Only in cpython-main/Modules/expat/: COPYING
Only in libexpat_2_6_2/expat/lib/: Makefile.am
Only in cpython-main/Modules/expat/: expat_config.h
diff -r -u libexpat_2_6_2/expat/lib/expat_external.h cpython-main/Modules/expat/expat_external.h
--- libexpat_2_6_2/expat/lib/expat_external.h   2024-09-04 18:04:32.429990554 +0000
+++ cpython-main/Modules/expat/expat_external.h 2024-09-04 18:04:21.161886969 +0000
@@ -64,6 +64,11 @@
    compiled with the cdecl calling convention as the default since
    system headers may assume the cdecl convention.
 */
+
+/* Namespace external symbols to allow multiple libexpat version to
+   co-exist. */
+#include "pyexpatns.h"
+
 #ifndef XMLCALL
 #  if defined(_MSC_VER)
 #    define XMLCALL __cdecl
Only in libexpat_2_6_2/expat/lib/: libexpat.def.cmake
Only in cpython-main/Modules/expat/: pyexpatns.h
Only in libexpat_2_6_3/expat/lib/: .gitignore
Only in cpython-pr/Modules/expat/: COPYING
Only in libexpat_2_6_3/expat/lib/: Makefile.am
Only in cpython-pr/Modules/expat/: expat_config.h
diff -r -u libexpat_2_6_3/expat/lib/expat_external.h cpython-pr/Modules/expat/expat_external.h
--- libexpat_2_6_3/expat/lib/expat_external.h   2024-09-04 18:04:35.764021202 +0000
+++ cpython-pr/Modules/expat/expat_external.h   2024-09-04 18:04:29.352962267 +0000
@@ -64,6 +64,11 @@
    compiled with the cdecl calling convention as the default since
    system headers may assume the cdecl convention.
 */
+
+/* Namespace external symbols to allow multiple libexpat version to
+   co-exist. */
+#include "pyexpatns.h"
+
 #ifndef XMLCALL
 #  if defined(_MSC_VER)
 #    define XMLCALL __cdecl
Only in libexpat_2_6_3/expat/lib/: libexpat.def.cmake
Only in cpython-pr/Modules/expat/: pyexpatns.h
Diff is good.
 ---> Removed intermediate container 03fb2eed1a29
 ---> e85a4065bbe4
Successfully built e85a4065bbe4

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions
@bedevere-app bedevere-app Bot added awaiting core review and removed awaiting review labels Sep 4, 2024
gpshead
gpshead approved these changes Sep 4, 2024
View reviewed changes
@bedevere-app bedevere-app Bot added awaiting merge and removed awaiting core review labels Sep 4, 2024
@gpshead gpshead added needs backport to 3.8 needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes needs backport to 3.13 only security fixes labels Sep 4, 2024
@gpshead
gpshead merged commit 40bdb0d into python:main Sep 4, 2024
@bedevere-app bedevere-app Bot removed the awaiting merge label Sep 4, 2024
@miss-islington-app

miss-islington-app Bot commented Sep 4, 2024

Copy link
Copy Markdown

Thanks @sethmlarson for the PR, and @gpshead for merging it 🌮🎉.. I'm working now to backport this PR to: 3.8, 3.9, 3.10, 3.11, 3.12, 3.13.
🐍🍒⛏🤖

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Sep 4, 2024
@sethmlarson @miss-islington
pythongh-123678: Upgrade libexpat 2.6.3 (pythonGH-123689)
054b5b6
Upgrade libexpat 2.6.3
(cherry picked from commit 40bdb0d)

Co-authored-by: Seth Michael Larson <[email protected]>
@bedevere-app

bedevere-app Bot commented Sep 4, 2024

Copy link
Copy Markdown

GH-123707 is a backport of this pull request to the 3.13 branch.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Sep 4, 2024
@sethmlarson @miss-islington
pythongh-123678: Upgrade libexpat 2.6.3 (pythonGH-123689)
3c290df
Upgrade libexpat 2.6.3
(cherry picked from commit 40bdb0d)

Co-authored-by: Seth Michael Larson <[email protected]>
@bedevere-app bedevere-app Bot removed the needs backport to 3.13 only security fixes label Sep 4, 2024
@miss-islington-app

miss-islington-app Bot commented Sep 4, 2024

Copy link
Copy Markdown

Sorry, @sethmlarson and @gpshead, I could not cleanly backport this to 3.11 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 40bdb0deee746e51c71c56329df21e5172fd8aa0 3.11
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@bedevere-app

bedevere-app Bot commented Sep 4, 2024

Copy link
Copy Markdown

GH-123708 is a backport of this pull request to the 3.12 branch.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@miss-islington-app miss-islington-app Bot assigned gpshead Sep 4, 2024
@bedevere-app bedevere-app Bot removed the needs backport to 3.12 only security fixes label Sep 4, 2024
@miss-islington-app

miss-islington-app Bot commented Sep 4, 2024

Copy link
Copy Markdown

Sorry, @sethmlarson and @gpshead, I could not cleanly backport this to 3.10 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 40bdb0deee746e51c71c56329df21e5172fd8aa0 3.10
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@sethmlarson
sethmlarson deleted the expat-2.6.3 branch September 4, 2024 19:58
@miss-islington-app

miss-islington-app Bot commented Sep 4, 2024

Copy link
Copy Markdown

Sorry, @sethmlarson and @gpshead, I could not cleanly backport this to 3.9 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 40bdb0deee746e51c71c56329df21e5172fd8aa0 3.9
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@sethmlarson

sethmlarson commented Sep 4, 2024

Copy link
Copy Markdown
Contributor Author

Ah I'll close the backports that succeeded and handle the rest, thanks @gpshead!

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@miss-islington-app

miss-islington-app Bot commented Sep 4, 2024

Copy link
Copy Markdown

Sorry, @sethmlarson and @gpshead, I could not cleanly backport this to 3.8 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 40bdb0deee746e51c71c56329df21e5172fd8aa0 3.8
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@gpshead

gpshead commented Sep 4, 2024

Copy link
Copy Markdown
Member

I'm not sure if this needs further backporting or not, i didn't look to see what versions those used. the specific int vs size_t change for the bugfix could likely be manually applied if relevant though. leaving that up to you.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@sethmlarson

sethmlarson commented Sep 4, 2024

Copy link
Copy Markdown
Contributor Author

@gpshead Looks like every branch is upgradeable, so I went ahead and backported to every branch. Those PRs can be closed if we decide not to move forward with them.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@sethmlarson sethmlarson removed needs backport to 3.8 needs backport to 3.11 only security fixes labels Sep 4, 2024
@hartwork

hartwork commented Sep 4, 2024

Copy link
Copy Markdown
Contributor

@gpshead Looks like every branch is upgradeable, so I went ahead and backported to every branch.

@sethmlarson 👍 👍

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

gpshead pushed a commit that referenced this pull request Sep 4, 2024
@miss-islington @sethmlarson
[3.12] gh-123678: Upgrade libexpat 2.6.3 (GH-123689) (GH-123708)
3cf7d33
gh-123678: Upgrade libexpat 2.6.3 (GH-123689)

Upgrade libexpat 2.6.3
(cherry picked from commit 40bdb0d)

Co-authored-by: Seth Michael Larson <[email protected]>
encukou pushed a commit that referenced this pull request Sep 5, 2024
@miss-islington @sethmlarson
[3.13] gh-123678: Upgrade libexpat 2.6.3 (GH-123689) (GH-123707)
9810dfa
gh-123678: Upgrade libexpat 2.6.3 (GH-123689)

(cherry picked from commit 40bdb0d)

Co-authored-by: Seth Michael Larson <[email protected]>
@hartwork hartwork mentioned this pull request Nov 9, 2024
Please upgrade bundled Expat to 2.6.4 (e.g. for the fix to CVE-2024-50602) #126623
Closed
@hartwork hartwork mentioned this pull request Mar 14, 2025
Please upgrade bundled Expat to 2.7.0 (e.g. for the fix to CVE-2024-8176) #131261
Closed
@hartwork hartwork mentioned this pull request Mar 27, 2025
Please upgrade bundled Expat to 2.7.1 #131809
Closed
@hartwork hartwork mentioned this pull request Sep 16, 2025
Upgrade bundled Expat to 2.7.2 (e.g. for the fix to CVE-2025-59375) #138998
Closed
@hartwork hartwork mentioned this pull request Sep 24, 2025
Please upgrade bundled Expat to 2.7.3 (e.g. for two key bugfixes) #139312
Closed
@hartwork hartwork mentioned this pull request Jan 31, 2026
[security] Please upgrade bundled Expat to 2.7.4 (e.g. for the fixes to CVE-2026-24515 and CVE-2026-25210) #144363
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@gpshead gpshead gpshead approved these changes
+1 more reviewer
@hartwork hartwork hartwork approved these changes
Reviewers whose approvals may not affect merge requirements

Uh oh!

There was an error while loading. Please reload this page.

Assignees

@gpshead gpshead

Labels

type-security A security issue

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

3 participants

@sethmlarson @gpshead @hartwork
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.