FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

gh-131261: Update libexpat to 2.7.0 (CVE-2024-8176) by gpshead · Pull Request #131272 · python/cpython · GitHub

  1. python
  2. cpython

Repository navigation

gh-131261: Update libexpat to 2.7.0 (CVE-2024-8176) - #131272

Merged
encukou merged 5 commits into
python:mainfrom
gpshead:security/3p/libexpat/1.7.0
Mar 17, 2025
ConversationCommits (5)ChecksFiles changed
Merged

gh-131261: Update libexpat to 2.7.0 (CVE-2024-8176)#131272
encukou merged 5 commits into
python:mainfrom
gpshead:security/3p/libexpat/1.7.0

Conversation

gpshead commented Mar 15, 2025 •
edited by bedevere-app Bot
Loading

Copy link
Copy Markdown
Member

A straightforward upgrade from expat 2.6.4 to 2.7.0. See the issue.

gpshead added the type-security A security issue label Mar 15, 2025
gpshead requested a review from sethmlarson March 15, 2025 06:30
bedevere-app Bot mentioned this pull request Mar 15, 2025
Closed
gpshead changed the title gh-131261: Update the libexpat to 2.7.0 (CVE-2024-8176) gh-131261: Update libexpat to 2.7.0 (CVE-2024-8176) Mar 15, 2025
gpshead added the 🔨 test-with-buildbots Test PR w/ buildbots; report in status section label Mar 15, 2025

bedevere-bot commented Mar 15, 2025

Copy link
Copy Markdown

🤖 New build scheduled with the buildbot fleet by @gpshead for commit 9b00232 🤖

Results will be shown at:

https://buildbot.python.org/all/#/grid?branch=refs%2Fpull%2F131272%2Fmerge

If you want to schedule another build, you need to add the 🔨 test-with-buildbots label again.

bedevere-bot removed the 🔨 test-with-buildbots Test PR w/ buildbots; report in status section label Mar 15, 2025
gpshead requested a review from encukou March 15, 2025 18:13
zware approved these changes Mar 15, 2025
View reviewed changes
Comment thread Misc/NEWS.d/next/Security/2025-03-14-23-28-39.gh-issue-131261.0aB6nM.rst
@@ -0,0 +1 @@
Upgrade to libexpat 2.7.0

zware Mar 15, 2025

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

Should this mention the CVE?

gpshead Mar 17, 2025

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

the previous 2.6.3 update didn't so I didn't here, but maybe? no strong opinion myself.

sethmlarson approved these changes Mar 17, 2025
View reviewed changes

sethmlarson left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

LGTM, I don't think it's necessary to mention the CVE in the changelog as the component is recorded in an SBOM.

encukou approved these changes Mar 17, 2025
View reviewed changes

encukou left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

I confirm that the patch matches 2.7.0.

I didn't review the patch itself; I'd probably need days to grok the code.

encukou merged commit bb0268f into python:main Mar 17, 2025

miss-islington-app Bot commented Mar 17, 2025

Copy link
Copy Markdown

Thanks @gpshead for the PR, and @encukou for merging it 🌮🎉.. I'm working now to backport this PR to: 3.9, 3.10, 3.11, 3.12, 3.13.
🐍🍒⛏🤖

miss-islington-app Bot commented Mar 17, 2025

Copy link
Copy Markdown

Sorry, @gpshead and @encukou, I could not cleanly backport this to 3.13 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker bb0268f60dfe903a9bdb8d84104247a9318c6b18 3.13

miss-islington-app Bot assigned encukou and unassigned gpshead and sethmlarson Mar 17, 2025

miss-islington-app Bot commented Mar 17, 2025

Copy link
Copy Markdown

Sorry, @gpshead and @encukou, I could not cleanly backport this to 3.12 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker bb0268f60dfe903a9bdb8d84104247a9318c6b18 3.12

miss-islington-app Bot commented Mar 17, 2025

Copy link
Copy Markdown

Sorry, @gpshead and @encukou, I could not cleanly backport this to 3.11 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker bb0268f60dfe903a9bdb8d84104247a9318c6b18 3.11

miss-islington-app Bot commented Mar 17, 2025

Copy link
Copy Markdown

Sorry, @gpshead and @encukou, I could not cleanly backport this to 3.10 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker bb0268f60dfe903a9bdb8d84104247a9318c6b18 3.10

miss-islington-app Bot commented Mar 17, 2025

Copy link
Copy Markdown

Sorry, @gpshead and @encukou, I could not cleanly backport this to 3.9 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker bb0268f60dfe903a9bdb8d84104247a9318c6b18 3.9

encukou commented Mar 17, 2025

Copy link
Copy Markdown
Member

I'm backporting.

bedevere-app Bot commented Mar 17, 2025

Copy link
Copy Markdown

GH-131360 is a backport of this pull request to the 3.13 branch.

bedevere-app Bot removed the needs backport to 3.13 only security fixes label Mar 17, 2025
encukou pushed a commit to encukou/cpython that referenced this pull request Mar 17, 2025
[3.13] pythongh-131261: Update libexpat to 2.7.0 (CVE-2024-8176) (pyt…
4b0d55d 
…honGH-131272)

(cherry picked from commit bb0268f)

Co-authored-by: Gregory P. Smith <greg@krypto.org>

bedevere-app Bot commented Mar 17, 2025

Copy link
Copy Markdown

GH-131362 is a backport of this pull request to the 3.11 branch.

bedevere-app Bot removed the needs backport to 3.11 only security fixes label Mar 17, 2025

bedevere-app Bot commented Mar 17, 2025

Copy link
Copy Markdown

GH-131363 is a backport of this pull request to the 3.10 branch.

bedevere-app Bot commented Mar 17, 2025

Copy link
Copy Markdown

GH-131364 is a backport of this pull request to the 3.9 branch.

plashchynski pushed a commit to plashchynski/cpython that referenced this pull request Mar 17, 2025
pythongh-131261: Update libexpat to 2.7.0 (CVE-2024-8176) (python#131272
47057de 
)
hartwork mentioned this pull request Mar 27, 2025
Closed
pablogsal pushed a commit that referenced this pull request Apr 1, 2025
[3.10] gh-131261: Update libexpat to 2.7.0 (CVE-2024-8176) (GH-131272) (
b22e607 
#131363)
ambv pushed a commit that referenced this pull request Apr 3, 2025
[3.11] gh-131261: Update libexpat to 2.7.0 (CVE-2024-8176) (GH-131272) (
ba49eab 
GH-131362)

(cherry picked from commit bb0268f)
(cherry picked from commit 6af54d2)

Co-authored-by: Petr Viktorin <encukou@gmail.com>
Co-authored-by: Gregory P. Smith <greg@krypto.org>
ambv pushed a commit that referenced this pull request Apr 3, 2025
[3.9] gh-131261: Update libexpat to 2.7.0 (CVE-2024-8176) (GH-131272) (…
8ad2d88 
…GH-131364)

(cherry picked from commit bb0268f)
(cherry picked from commit 6af54d2)

Co-authored-by: Petr Viktorin <encukou@gmail.com>
Co-authored-by: Gregory P. Smith <greg@krypto.org>
hugovk removed the needs backport to 3.12 only security fixes label Apr 8, 2025
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

encukou encukou approved these changes
zware zware approved these changes
sethmlarson sethmlarson approved these changes

Assignees

encukou

Labels

release-blocker type-security A security issue

Projects

Release and Deferred blockers 🚫
Status: Done

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

6 participants

Back | FazBrowse Home | New Git URL