Repository navigation
Please upgrade bundled Expat to 2.7.0 (e.g. for the fix to CVE-2024-8176) #131261
Description
Bug report
Bug description:
Hi! 👋
Please upgrade bundled Expat to 2.7.0 (e.g. for the fix to CVE-2024-8176).
- GitHub release: https://github.com/libexpat/libexpat/releases/tag/R_2_7_0
- Change log: https://github.com/libexpat/libexpat/blob/R_2_7_0/expat/Changes
- Bonus: Blog post Recursion kills: The story behind CVE-2024-8176 in libexpat
The CPython issue for previous 2.6.4 was #126623 and the related merged main pull request was #126792, in case you want to have a look. The Dockerfile from comment #123689 (review) could be of help with raising confidence in a bump pull request when going forward.
Thanks in advance!
CPython versions tested on:
3.9, 3.10, 3.11, 3.12, 3.13, 3.14, CPython main branch
Operating systems tested on:
Linux, macOS, Windows, Other
Linked PRs
- gh-131261: Update libexpat to 2.7.0 (CVE-2024-8176) #131272
- gh-131261: expat/refresh.sh: Expand list of manual steps #131359
- [3.13] gh-131261: Update libexpat to 2.7.0 (CVE-2024-8176) (GH-131272) #131360
- [3.12] gh-131261: Update libexpat to 2.7.0 (CVE-2024-8176) #131361
- [3.11] gh-131261: Update libexpat to 2.7.0 (CVE-2024-8176) (GH-131272) #131362
- [3.10] gh-131261: Update libexpat to 2.7.0 (CVE-2024-8176) (GH-131272) #131363
- [3.9] gh-131261: Update libexpat to 2.7.0 (CVE-2024-8176) (GH-131272) #131364
- [3.13] gh-131261: generate_sbom.py: Exclude the refresh script from SBOM (GH-131359) #144625
- [3.12] gh-131261: generate_sbom.py: Exclude the refresh script from SBOM (GH-131359) (GH-144625) #144660
Activity
12 remaining items
gpshead commented on Mar 18, 2025
For those watching: chatting with @sethmlarson, we decided this one is not worth expedited security releases on. this should land in our next regularly scheduled releases seen in https://peps.python.org/topic/release/.
hartwork commented on Mar 18, 2025
Thanks for updating and sharing that info! 👍
pythongh-131261: expat/refresh.sh: Expand list of manual steps (pytho…
[3.10] gh-131261: Update libexpat to 2.7.0 (CVE-2024-8176) (GH-131272) (
[3.11] gh-131261: Update libexpat to 2.7.0 (CVE-2024-8176) (GH-131272) (
[3.9] gh-131261: Update libexpat to 2.7.0 (CVE-2024-8176) (GH-131272) (…
hugovk commented on Apr 7, 2025
2.7.0 is merged and backported, see #131809 / #132192 for 2.7.1.
pythongh-131261: expat/refresh.sh: Expand list of manual steps (pytho…
pythongh-131261: expat/refresh.sh: Expand list of manual steps (pytho…
[3.13] pythongh-131261: expat/refresh.sh: Expand list of manual steps (…
[3.13] gh-131261: generate_sbom.py: Exclude the refresh script from S…
[3.13] pythongh-131261: generate_sbom.py: Exclude the refresh script …
Revert "pythongh-131261: expat/refresh.sh: Expand list of manual steps (