GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — gh-131261: Update libexpat to 2.7.0 (CVE-2024-8176) by gpshead · Pull Request #131272 · python/cpython

Conversation

gpshead commented Mar 15, 2025 •

edited by bedevere-app Bot

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Member

A straightforward upgrade from expat 2.6.4 to 2.7.0. See the issue.

Issue: Please upgrade bundled Expat to 2.7.0 (e.g. for the fix to CVE-2024-8176) #131261

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

gpshead added 3 commits

March 14, 2025 23:23


          Update expat refresh script to 2.7.0.

eed9d8a


          Upgrade to expat 2.7.0.

fb387c8


          NEWS blurb

9a7a567

gpshead added the type-security A security issue label

Mar 15, 2025

gpshead requested a review from sethmlarson

March 15, 2025 06:30

bedevere-app Bot added the awaiting core review label

Mar 15, 2025

bedevere-app Bot mentioned this pull request

Mar 15, 2025

Please upgrade bundled Expat to 2.7.0 (e.g. for the fix to CVE-2024-8176) #131261

Closed

gpshead added needs backport to 3.9 needs backport to 3.11

only security fixes

needs backport to 3.12

only security fixes

needs backport to 3.13

only security fixes

release-blocker labels

Mar 15, 2025

github-project-automation Bot added this to Release and Deferred blockers 🚫

Mar 15, 2025

github-project-automation Bot moved this to Todo in Release and Deferred blockers 🚫

Mar 15, 2025

gpshead changed the title ~~gh-131261: Update the libexpat to 2.7.0 (CVE-2024-8176)~~ gh-131261: Update libexpat to 2.7.0 (CVE-2024-8176)

Mar 15, 2025

gpshead added 2 commits

March 14, 2025 23:35


          make regen-sbom

faa9f45


          update the count of expected warnings in xmlparse on macOS

9b00232

gpshead added the 🔨 test-with-buildbots Test PR w/ buildbots; report in status section label

Mar 15, 2025

bedevere-bot commented Mar 15, 2025

Copy link

Copy Markdown

🤖 New build scheduled with the buildbot fleet by @gpshead for commit 9b00232 🤖

Results will be shown at:

https://buildbot.python.org/all/#/grid?branch=refs%2Fpull%2F131272%2Fmerge

If you want to schedule another build, you need to add the 🔨 test-with-buildbots label again.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

bedevere-bot removed the 🔨 test-with-buildbots Test PR w/ buildbots; report in status section label

Mar 15, 2025

gpshead assigned gpshead and sethmlarson

Mar 15, 2025

gpshead requested a review from encukou

March 15, 2025 18:13

zware approved these changes

Mar 15, 2025

View reviewed changes

Comment thread

Misc/NEWS.d/next/Security/2025-03-14-23-28-39.gh-issue-131261.0aB6nM.rst

		@@ -0,0 +1 @@
		Upgrade to libexpat 2.7.0

zware Mar 15, 2025

Copy link

Copy Markdown

Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should this mention the CVE?

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

sethmlarson reacted with thumbs up emoji

All reactions

👍 1 reaction

gpshead Mar 17, 2025

Copy link

Copy Markdown

Member Author

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the previous 2.6.3 update didn't so I didn't here, but maybe? no strong opinion myself.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

zware reacted with thumbs up emoji

All reactions

👍 1 reaction

bedevere-app Bot added awaiting merge and removed awaiting core review labels

Mar 15, 2025

sethmlarson approved these changes

Mar 17, 2025

View reviewed changes

sethmlarson left a comment

Copy link

Copy Markdown

Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, I don't think it's necessary to mention the CVE in the changelog as the component is recorded in an SBOM.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

encukou approved these changes

Mar 17, 2025

View reviewed changes

encukou left a comment

Copy link

Copy Markdown

Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I confirm that the patch matches 2.7.0.

I didn't review the patch itself; I'd probably need days to grok the code.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

encukou merged commit bb0268f into python:main

Mar 17, 2025

github-project-automation Bot moved this from Todo to Done in Release and Deferred blockers 🚫

Mar 17, 2025

miss-islington-app Bot commented Mar 17, 2025

Copy link

Copy Markdown

Thanks @gpshead for the PR, and @encukou for merging it 🌮🎉.. I'm working now to backport this PR to: 3.9, 3.10, 3.11, 3.12, 3.13.
🐍🍒⛏🤖

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

bedevere-app Bot removed the awaiting merge label

Mar 17, 2025

miss-islington-app Bot commented Mar 17, 2025

Copy link

Copy Markdown

Sorry, @gpshead and @encukou, I could not cleanly backport this to 3.13 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker bb0268f60dfe903a9bdb8d84104247a9318c6b18 3.13

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

miss-islington-app Bot assigned encukou and unassigned gpshead and sethmlarson

Mar 17, 2025

miss-islington-app Bot commented Mar 17, 2025

Copy link

Copy Markdown

Sorry, @gpshead and @encukou, I could not cleanly backport this to 3.12 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker bb0268f60dfe903a9bdb8d84104247a9318c6b18 3.12

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

miss-islington-app Bot commented Mar 17, 2025

Copy link

Copy Markdown

Sorry, @gpshead and @encukou, I could not cleanly backport this to 3.11 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker bb0268f60dfe903a9bdb8d84104247a9318c6b18 3.11

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

miss-islington-app Bot commented Mar 17, 2025

Copy link

Copy Markdown

Sorry, @gpshead and @encukou, I could not cleanly backport this to 3.10 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker bb0268f60dfe903a9bdb8d84104247a9318c6b18 3.10

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

miss-islington-app Bot commented Mar 17, 2025

Copy link

Copy Markdown

Sorry, @gpshead and @encukou, I could not cleanly backport this to 3.9 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker bb0268f60dfe903a9bdb8d84104247a9318c6b18 3.9

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

encukou commented Mar 17, 2025

Copy link

Copy Markdown

Member

I'm backporting.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

bedevere-app Bot commented Mar 17, 2025

Copy link

Copy Markdown

GH-131360 is a backport of this pull request to the 3.13 branch.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

bedevere-app Bot removed the needs backport to 3.13 only security fixes label

Mar 17, 2025

encukou pushed a commit to encukou/cpython that referenced this pull request

Mar 17, 2025


          [3.13] pythongh-131261: Update libexpat to 2.7.0 (CVE-2024-8176) (pyt…

4b0d55d

…honGH-131272)

(cherry picked from commit bb0268f)

Co-authored-by: Gregory P. Smith <[email protected]>

bedevere-app Bot commented Mar 17, 2025

Copy link

Copy Markdown

GH-131362 is a backport of this pull request to the 3.11 branch.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

bedevere-app Bot removed the needs backport to 3.11 only security fixes label

Mar 17, 2025

bedevere-app Bot commented Mar 17, 2025

Copy link

Copy Markdown

GH-131363 is a backport of this pull request to the 3.10 branch.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

bedevere-app Bot removed the needs backport to 3.10 label

Mar 17, 2025

bedevere-app Bot commented Mar 17, 2025

Copy link

Copy Markdown

GH-131364 is a backport of this pull request to the 3.9 branch.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

bedevere-app Bot removed the needs backport to 3.9 label

Mar 17, 2025

plashchynski pushed a commit to plashchynski/cpython that referenced this pull request

Mar 17, 2025


          pythongh-131261: Update libexpat to 2.7.0 (CVE-2024-8176) (python#131272

47057de

hartwork mentioned this pull request

Mar 27, 2025

Please upgrade bundled Expat to 2.7.1 #131809

Closed

pablogsal pushed a commit that referenced this pull request

Apr 1, 2025


          [3.10] gh-131261: Update libexpat to 2.7.0 (CVE-2024-8176) (GH-131272) (

b22e607

#131363)

ambv pushed a commit that referenced this pull request

Apr 3, 2025


          [3.11] gh-131261: Update libexpat to 2.7.0 (CVE-2024-8176) (GH-131272) (

ba49eab

GH-131362)

(cherry picked from commit bb0268f)
(cherry picked from commit 6af54d2)

Co-authored-by: Petr Viktorin <[email protected]>
Co-authored-by: Gregory P. Smith <[email protected]>

ambv pushed a commit that referenced this pull request

Apr 3, 2025


          [3.9] gh-131261: Update libexpat to 2.7.0 (CVE-2024-8176) (GH-131272) (…

8ad2d88

…GH-131364)

(cherry picked from commit bb0268f)
(cherry picked from commit 6af54d2)

Co-authored-by: Petr Viktorin <[email protected]>
Co-authored-by: Gregory P. Smith <[email protected]>

hugovk removed the needs backport to 3.12 only security fixes label

Apr 8, 2025

Reviewers

encukou

encukou approved these changes

zware

zware approved these changes

sethmlarson

sethmlarson approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

encukou

Labels

release-blocker type-security

A security issue

Projects

Release and Deferred blockers 🚫

Status: Done

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

6 participants

Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.

GeezerVison

Conversation

gpshead commented Mar 15, 2025 • edited by bedevere-app Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bedevere-bot commented Mar 15, 2025

Uh oh!

zware Mar 15, 2025

Choose a reason for hiding this comment

Uh oh!

gpshead Mar 17, 2025

Choose a reason for hiding this comment

Uh oh!

sethmlarson left a comment

Choose a reason for hiding this comment

Uh oh!

encukou left a comment

Choose a reason for hiding this comment

Uh oh!

miss-islington-app Bot commented Mar 17, 2025

Uh oh!

miss-islington-app Bot commented Mar 17, 2025

Uh oh!

miss-islington-app Bot commented Mar 17, 2025

Uh oh!

miss-islington-app Bot commented Mar 17, 2025

Uh oh!

miss-islington-app Bot commented Mar 17, 2025

Uh oh!

miss-islington-app Bot commented Mar 17, 2025

Uh oh!

encukou commented Mar 17, 2025

Uh oh!

bedevere-app Bot commented Mar 17, 2025

Uh oh!

bedevere-app Bot commented Mar 17, 2025

Uh oh!

bedevere-app Bot commented Mar 17, 2025

Uh oh!

bedevere-app Bot commented Mar 17, 2025

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

gpshead commented Mar 15, 2025 •

edited by bedevere-app Bot

Loading

Uh oh!

There was an error while loading. Please reload this page.