Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Please upgrade bundled Expat to 2.6.3 (e.g. for the fixes to CVE-2024-45490, CVE-2024-45491 and CVE-2024-45492) #123678

Closed
hartwork opened this issue Sep 4, 2024 · 4 comments
Closed

Please upgrade bundled Expat to 2.6.3 (e.g. for the fixes to CVE-2024-45490, CVE-2024-45491 and CVE-2024-45492) #123678

hartwork opened this issue Sep 4, 2024 · 4 comments
Assignees
@sethmlarson
Labels
type-bug An unexpected behavior, bug, or error type-security A security issue

Comments

@hartwork
Copy link
Contributor

hartwork commented Sep 4, 2024 •
edited by bedevere-app bot
Loading

Bug report

Bug description:

Hi! 👋

Please upgrade bundled Expat to 2.6.3 (e.g. for the fixes to CVE-2024-45490, CVE-2024-45491 and CVE-2024-45492).

The CPython issue for previous 2.6.2 was #116741 and the related merged main pull request was #117296, in case you want to have a look. The Dockerfile from comment #117296 (review) could be of help with raising confidence in a bump pull request when going forward.

Thanks in advance!

CPython versions tested on:

3.8, 3.9, 3.10, 3.11, 3.12, 3.13, CPython main branch

Operating systems tested on:

Linux, macOS, Windows, Other

Linked PRs
@hartwork hartwork added the type-bug An unexpected behavior, bug, or error label Sep 4, 2024
@Eclips4 Eclips4 added the type-security A security issue label Sep 4, 2024
@sobolevn
Copy link
Member

sobolevn commented Sep 4, 2024

cc @sethmlarson

@sethmlarson
Copy link
Contributor

Thanks for the ping @sobolevn, I'll work with release managers to get this update out.

@bedevere-app bedevere-app bot mentioned this issue Sep 4, 2024
Merged
@sethmlarson
Copy link
Contributor

I've created a PR, please take a look: #123689

This was referenced Sep 4, 2024
Closed
Closed
gpshead pushed a commit that referenced this issue Sep 4, 2024
@sethmlarson
gh-123678: Upgrade libexpat 2.6.3 (#123689)
40bdb0d 
Upgrade libexpat 2.6.3
miss-islington pushed a commit to miss-islington/cpython that referenced this issue Sep 4, 2024
@sethmlarson @miss-islington
pythongh-123678: Upgrade libexpat 2.6.3 (pythonGH-123689)
054b5b6 
Upgrade libexpat 2.6.3
(cherry picked from commit 40bdb0d)

Co-authored-by: Seth Michael Larson <[email protected]>
miss-islington pushed a commit to miss-islington/cpython that referenced this issue Sep 4, 2024
@sethmlarson @miss-islington
pythongh-123678: Upgrade libexpat 2.6.3 (pythonGH-123689)
3c290df 
Upgrade libexpat 2.6.3
(cherry picked from commit 40bdb0d)

Co-authored-by: Seth Michael Larson <[email protected]>
This was referenced Sep 4, 2024
Merged
Merged
@sethmlarson sethmlarson self-assigned this Sep 4, 2024
This was referenced Sep 4, 2024
Merged
Merged
Merged
Merged
gpshead pushed a commit that referenced this issue Sep 4, 2024
@miss-islington @sethmlarson
[3.12] gh-123678: Upgrade libexpat 2.6.3 (GH-123689) (GH-123708)
3cf7d33 
gh-123678: Upgrade libexpat 2.6.3 (GH-123689)

Upgrade libexpat 2.6.3
(cherry picked from commit 40bdb0d)

Co-authored-by: Seth Michael Larson <[email protected]>
encukou pushed a commit that referenced this issue Sep 5, 2024
@miss-islington @sethmlarson
[3.13] gh-123678: Upgrade libexpat 2.6.3 (GH-123689) (GH-123707)
9810dfa 
gh-123678: Upgrade libexpat 2.6.3 (GH-123689)

(cherry picked from commit 40bdb0d)

Co-authored-by: Seth Michael Larson <[email protected]>
ambv pushed a commit that referenced this issue Sep 5, 2024
@sethmlarson
[3.11] gh-123678: Upgrade libexpat 2.6.3 (#123709)
b582d52 
(cherry picked from commit e6fe0ac)
ambv pushed a commit that referenced this issue Sep 5, 2024
@sethmlarson
[3.10] gh-123678: Upgrade libexpat 2.6.3 (#123710)
0e006ce 
(cherry picked from commit fdc04ad)
ambv pushed a commit that referenced this issue Sep 5, 2024
@sethmlarson
[3.9] gh-123678: Upgrade libexpat 2.6.3 (#123711)
c57c4a9 
(cherry picked from commit fdc04ad)
ambv pushed a commit that referenced this issue Sep 5, 2024
@sethmlarson
[3.8] gh-123678: Upgrade libexpat 2.6.3 (#123712)
a50a86d 
(cherry picked from commit fdc04ad)
@skupr-anaconda skupr-anaconda mentioned this issue Sep 5, 2024
Merged
@sethmlarson
Copy link
Contributor

All pull requests have been merged

@hartwork hartwork mentioned this issue Nov 9, 2024
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@sethmlarson sethmlarson

Labels
type-bug An unexpected behavior, bug, or error type-security A security issue
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@hartwork @sobolevn @sethmlarson @Eclips4