Skip to content

Please upgrade bundled Expat to 2.6.3 (e.g. for the fixes to CVE-2024-45490, CVE-2024-45491 and CVE-2024-45492)聽#123678

Closed
Closed
Please upgrade bundled Expat to 2.6.3 (e.g. for the fixes to CVE-2024-45490, CVE-2024-45491 and CVE-2024-45492)#123678
Assignees
sethmlarson
Labels
type-bugAn unexpected behavior, bug, or errortype-securityA security issue

Description

@hartwork
hartwork
opened on Sep 4, 2024

Bug report

Bug description:

Hi! 馃憢

Please upgrade bundled Expat to 2.6.3 (e.g. for the fixes to CVE-2024-45490, CVE-2024-45491 and CVE-2024-45492).

The CPython issue for previous 2.6.2 was #116741 and the related merged main pull request was #117296, in case you want to have a look. The Dockerfile from comment #117296 (review) could be of help with raising confidence in a bump pull request when going forward.

Thanks in advance!

CPython versions tested on:

3.8, 3.9, 3.10, 3.11, 3.12, 3.13, CPython main branch

Operating systems tested on:

Linux, macOS, Windows, Other

Linked PRs

Activity

  1. hartwork
    added
    type-bugAn unexpected behavior, bug, or error
    on Sep 4, 2024
  2. Eclips4
    added
    type-securityA security issue
    on Sep 4, 2024

  3. sobolevn commented on Sep 4, 2024

    @sobolevn
    sobolevn
    on Sep 4, 2024
    Member

    cc @sethmlarson

  4. sethmlarson commented on Sep 4, 2024

    @sethmlarson
    sethmlarson
    on Sep 4, 2024
    Contributor

    Thanks for the ping @sobolevn, I'll work with release managers to get this update out.

  5. sethmlarson commented on Sep 4, 2024

    @sethmlarson
    sethmlarson
    on Sep 4, 2024
    Contributor

    I've created a PR, please take a look: #123689

  6. gpshead
    added a commit that references this issue on Sep 4, 2024

    gh-123678: Upgrade libexpat 2.6.3 (#123689)

    40bdb0d
  7. miss-islington
    added 2 commits that reference this issue on Sep 4, 2024

    pythongh-123678: Upgrade libexpat 2.6.3 (pythonGH-123689)

    054b5b6

    pythongh-123678: Upgrade libexpat 2.6.3 (pythonGH-123689)

    3c290df
  8. sethmlarson
    self-assigned this
    on Sep 4, 2024
  9. gpshead
    added a commit that references this issue on Sep 4, 2024

    [3.12] gh-123678: Upgrade libexpat 2.6.3 (GH-123689) (GH-123708)

    3cf7d33
  10. encukou
    added a commit that references this issue on Sep 5, 2024

    [3.13] gh-123678: Upgrade libexpat 2.6.3 (GH-123689) (GH-123707)

    9810dfa
  11. ambv
    added 4 commits that reference this issue on Sep 5, 2024

    [3.11] gh-123678: Upgrade libexpat 2.6.3 (#123709)

    b582d52

    [3.10] gh-123678: Upgrade libexpat 2.6.3 (#123710)

    0e006ce

    [3.9] gh-123678: Upgrade libexpat 2.6.3 (#123711)

    c57c4a9

    [3.8] gh-123678: Upgrade libexpat 2.6.3 (#123712)

    a50a86d

  12. sethmlarson commented on Sep 5, 2024

    @sethmlarson
    sethmlarson
    on Sep 5, 2024
    Contributor

    All pull requests have been merged

  13. sethmlarson
    closed this as completedon Sep 5, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

type-bugAn unexpected behavior, bug, or errortype-securityA security issue

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions