Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[3.10] gh-115398: Expose Expat >=2.6.0 reparse deferral API (CVE-2023-52425) (GH-115623) #116270

Merged
merged 3 commits into from
Mar 6, 2024
Merged

[3.10] gh-115398: Expose Expat >=2.6.0 reparse deferral API (CVE-2023-52425) (GH-115623) #116270

merged 3 commits into from
Mar 6, 2024

Commits on Mar 3, 2024

  1. pythongh-115398: Expose Expat >=2.6.0 reparse deferral API (CVE-2023-… 

    …52425) (pythonGH-115623)

Allow controlling Expat >=2.6.0 reparse deferral (CVE-2023-52425) by adding five new methods:

- `xml.etree.ElementTree.XMLParser.flush`
- `xml.etree.ElementTree.XMLPullParser.flush`
- `xml.parsers.expat.xmlparser.GetReparseDeferralEnabled`
- `xml.parsers.expat.xmlparser.SetReparseDeferralEnabled`
- `xml.sax.expatreader.ExpatParser.flush`

Based on the "flush" idea from python#115138 (comment) .

- Please treat as a security fix related to CVE-2023-52425.

Includes code suggested-by: Snild Dolkow <[email protected]>
and by core dev Serhiy Storchaka.

(cherry picked from commit 6a95676)
    @hartwork
    hartwork committed Mar 3, 2024
    Configuration menu
    Copy the full SHA
    0444649 View commit details
    Browse the repository at this point in the history

Commits on Mar 6, 2024

  1. pythongh-115398: Suggest use of hasattr with checking for 3.13 Expa… 

    …t API availability (pythonGH-116278)

Suggest use of "hasattr" with checking for 3.13 Expat API availability

(cherry picked from commit 73807eb)
    @hartwork
    hartwork committed Mar 6, 2024
    Configuration menu
    Copy the full SHA
    08d0d6d View commit details
    Browse the repository at this point in the history

  2. RESTify news API list. 

    (cherry picked from commit eda2963)
    @gpshead @hartwork
    gpshead authored and hartwork committed Mar 6, 2024
    Configuration menu
    Copy the full SHA
    c4c8137 View commit details
    Browse the repository at this point in the history