Skip to content

Please upgrade bundled Expat to 2.6.4 (e.g. for the fix to CVE-2024-50602) #126623

Closed
Closed
Please upgrade bundled Expat to 2.6.4 (e.g. for the fix to CVE-2024-50602)#126623
Assignees
sethmlarson
Labels
3.10 (EOL)end of life3.11only security fixes3.12only security fixes3.13only security fixes3.14bugs and security fixes3.9 (EOL)end of lifeextension-modulesC modules in the Modules dirtopic-XMLtype-securityA security issue

Description

@hartwork
hartwork
opened on Nov 9, 2024

Bug report

Bug description:

Hi! 👋

Please upgrade bundled Expat to 2.6.4 (e.g. for the fix to CVE-2024-50602).

The CPython issue for previous 2.6.3 was #123678 and the related merged main pull request was #123689, in case you want to have a look. The Dockerfile from comment #123689 (review) could be of help with raising confidence in a bump pull request when going forward.

Thanks in advance!

CPython versions tested on:

3.9, 3.10, 3.11, 3.12, 3.13, 3.14, CPython main branch

Operating systems tested on:

Linux, macOS, Windows, Other

Linked PRs

Activity

  1. hartwork
    added
    type-bugAn unexpected behavior, bug, or error
    on Nov 9, 2024
  2. hugovk
    added
    type-securityA security issue
    on Nov 9, 2024
  3. ZeroIntensity
    added
    3.11only security fixes
    3.10 (EOL)end of life
    3.9 (EOL)end of life
    3.12only security fixes
    3.13only security fixes
    3.14bugs and security fixes
    on Nov 9, 2024

  4. ZeroIntensity commented on Nov 9, 2024

    @ZeroIntensity
    ZeroIntensity
    on Nov 9, 2024
    Member

    cc @sethmlarson

  5. picnixz
    added
    extension-modulesC modules in the Modules dir
    topic-XML
    and removed
    type-bugAn unexpected behavior, bug, or error
    on Nov 9, 2024
  6. erlend-aasland
    assigned
    sethmlarson
    on Nov 12, 2024
  7. gpshead
    added a commit that references this issue on Nov 13, 2024

    gh-126623: Update libexpat to 2.6.4, make future updates easier (GH-1…

    3c99969
  8. miss-islington
    added a commit that references this issue on Nov 13, 2024

    pythongh-126623: Update libexpat to 2.6.4, make future updates easier (…

    66d95bb

  9. 3 remaining items

  10. sethmlarson
    added 2 commits that reference this issue on Nov 13, 2024

    [3.9] pythongh-126623: Update libexpat to 2.6.4, make future updates …

    a60574e

    [3.8] pythongh-126623: Update libexpat to 2.6.4, make future updates …

    7d48f06
  11. gpshead
    added 2 commits that reference this issue on Nov 13, 2024

    [3.12] gh-126623: Update libexpat to 2.6.4, make future updates easier (

    9e86d21

    [3.13] gh-126623: Update libexpat to 2.6.4, make future updates easier (

    1d6ba84
  12. ambv
    added 3 commits that reference this issue on Dec 2, 2024

    [3.10] gh-126623: Update libexpat to 2.6.4, make future updates easier (

    b3a6042

    [3.9] gh-126623: Update libexpat to 2.6.4, make future updates easier (…

    6b8f442

    [3.11] gh-126623: Update libexpat to 2.6.4, make future updates easier (

    2e161e2

  13. ambv commented on Dec 3, 2024

    @ambv
    ambv
    on Dec 3, 2024
    Contributor

    Releases with the fix have gone out today. Thanks! ✨ 🍰 ✨

  14. ambv
    closed this as completedon Dec 3, 2024
  15. picnixz
    added a commit that references this issue on Dec 8, 2024

    pythongh-126623: Update libexpat to 2.6.4, make future updates easier (…

    115a7b3
  16. 07026
    added a commit that references this issue on Dec 15, 2024

    Create Pth

    9486c15

  17. bjjc09 commented on Dec 18, 2024

    @bjjc09
    bjjc09
    on Dec 18, 2024

    Ok

  18. skomar77 commented on Dec 23, 2024

    @skomar77
    skomar77
    on Dec 23, 2024 · Hidden as spam

  19. skomar77 commented on Dec 23, 2024

    @skomar77
    skomar77
    on Dec 23, 2024 · Hidden as spam
  20. python
    locked as spam and limited conversation to collaborators on Dec 23, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

3.10 (EOL)end of life3.11only security fixes3.12only security fixes3.13only security fixes3.14bugs and security fixes3.9 (EOL)end of lifeextension-modulesC modules in the Modules dirtopic-XMLtype-securityA security issue

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions