Skip to content

gh-131261: Update libexpat to 2.7.0 (CVE-2024-8176)#131272

Merged
encukou merged 5 commits intopython:mainfrom
gpshead:security/3p/libexpat/1.7.0
Mar 17, 2025
Merged

gh-131261: Update libexpat to 2.7.0 (CVE-2024-8176)#131272
encukou merged 5 commits intopython:mainfrom
gpshead:security/3p/libexpat/1.7.0

Conversation

@gpshead
Copy link
Member

@gpshead gpshead commented Mar 15, 2025 •
edited by bedevere-app bot
Loading

A straightforward upgrade from expat 2.6.4 to 2.7.0. See the issue.

@gpshead gpshead added the type-security A security issue label Mar 15, 2025
@gpshead gpshead requested a review from sethmlarson March 15, 2025 06:30
@bedevere-app bedevere-app bot mentioned this pull request Mar 15, 2025
Closed
@gpshead gpshead changed the title gh-131261: Update the libexpat to 2.7.0 (CVE-2024-8176) gh-131261: Update libexpat to 2.7.0 (CVE-2024-8176) Mar 15, 2025
@gpshead gpshead added the 🔨 test-with-buildbots Test PR w/ buildbots; report in status section label Mar 15, 2025
@bedevere-bot
Copy link

bedevere-bot commented Mar 15, 2025

🤖 New build scheduled with the buildbot fleet by @gpshead for commit 9b00232 🤖

Results will be shown at:

https://buildbot.python.org/all/#/grid?branch=refs%2Fpull%2F131272%2Fmerge

If you want to schedule another build, you need to add the 🔨 test-with-buildbots label again.

@bedevere-bot bedevere-bot removed the 🔨 test-with-buildbots Test PR w/ buildbots; report in status section label Mar 15, 2025
@gpshead gpshead requested a review from encukou March 15, 2025 18:13
zware
zware approved these changes Mar 15, 2025
View reviewed changes
Misc/NEWS.d/next/Security/2025-03-14-23-28-39.gh-issue-131261.0aB6nM.rst
@@ -0,0 +1 @@
Upgrade to libexpat 2.7.0
Copy link
Member

@zware zware Mar 15, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should this mention the CVE?

Copy link
Member Author

@gpshead gpshead Mar 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the previous 2.6.3 update didn't so I didn't here, but maybe? no strong opinion myself.

sethmlarson
sethmlarson approved these changes Mar 17, 2025
View reviewed changes
Copy link
Contributor

@sethmlarson sethmlarson left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, I don't think it's necessary to mention the CVE in the changelog as the component is recorded in an SBOM.

encukou
encukou approved these changes Mar 17, 2025
View reviewed changes
Copy link
Member

@encukou encukou left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I confirm that the patch matches 2.7.0.

I didn't review the patch itself; I'd probably need days to grok the code.

@encukou encukou merged commit bb0268f into python:main Mar 17, 2025
123 checks passed
@miss-islington-app
Copy link

miss-islington-app bot commented Mar 17, 2025

Thanks @gpshead for the PR, and @encukou for merging it 🌮🎉.. I'm working now to backport this PR to: 3.9, 3.10, 3.11, 3.12, 3.13.
🐍🍒⛏🤖

@miss-islington-app
Copy link

miss-islington-app bot commented Mar 17, 2025

Sorry, @gpshead and @encukou, I could not cleanly backport this to 3.13 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker bb0268f60dfe903a9bdb8d84104247a9318c6b18 3.13

@miss-islington-app miss-islington-app bot assigned encukou and unassigned gpshead and sethmlarson Mar 17, 2025
@miss-islington-app
Copy link

miss-islington-app bot commented Mar 17, 2025

Sorry, @gpshead and @encukou, I could not cleanly backport this to 3.12 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker bb0268f60dfe903a9bdb8d84104247a9318c6b18 3.12

@miss-islington-app
Copy link

miss-islington-app bot commented Mar 17, 2025

Sorry, @gpshead and @encukou, I could not cleanly backport this to 3.11 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker bb0268f60dfe903a9bdb8d84104247a9318c6b18 3.11

@miss-islington-app
Copy link

miss-islington-app bot commented Mar 17, 2025

Sorry, @gpshead and @encukou, I could not cleanly backport this to 3.10 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker bb0268f60dfe903a9bdb8d84104247a9318c6b18 3.10

@miss-islington-app
Copy link

miss-islington-app bot commented Mar 17, 2025

Sorry, @gpshead and @encukou, I could not cleanly backport this to 3.9 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker bb0268f60dfe903a9bdb8d84104247a9318c6b18 3.9

@encukou
Copy link
Member

encukou commented Mar 17, 2025

I'm backporting.

@bedevere-app
Copy link

bedevere-app bot commented Mar 17, 2025

GH-131360 is a backport of this pull request to the 3.13 branch.

@bedevere-app bedevere-app bot removed the needs backport to 3.13 bugs and security fixes label Mar 17, 2025
encukou pushed a commit to encukou/cpython that referenced this pull request Mar 17, 2025
@gpshead @encukou
[3.13] pythongh-131261: Update libexpat to 2.7.0 (CVE-2024-8176) (pyt…
4b0d55d 
…honGH-131272)

(cherry picked from commit bb0268f)

Co-authored-by: Gregory P. Smith <greg@krypto.org>
@bedevere-app
Copy link

bedevere-app bot commented Mar 17, 2025

GH-131362 is a backport of this pull request to the 3.11 branch.

@bedevere-app bedevere-app bot removed the needs backport to 3.11 only security fixes label Mar 17, 2025
@bedevere-app
Copy link

bedevere-app bot commented Mar 17, 2025

GH-131363 is a backport of this pull request to the 3.10 branch.

@bedevere-app bedevere-app bot removed the needs backport to 3.10 only security fixes label Mar 17, 2025
@bedevere-app
Copy link

bedevere-app bot commented Mar 17, 2025

GH-131364 is a backport of this pull request to the 3.9 branch.

plashchynski pushed a commit to plashchynski/cpython that referenced this pull request Mar 17, 2025
@gpshead @plashchynski
pythongh-131261: Update libexpat to 2.7.0 (CVE-2024-8176) (python#131272
47057de 
)
@hartwork hartwork mentioned this pull request Mar 27, 2025
Closed
pablogsal pushed a commit that referenced this pull request Apr 1, 2025
@sethmlarson
[3.10] gh-131261: Update libexpat to 2.7.0 (CVE-2024-8176) (GH-131272) (
b22e607 
#131363)
ambv pushed a commit that referenced this pull request Apr 3, 2025
@sethmlarson @encukou @gpshead
[3.11] gh-131261: Update libexpat to 2.7.0 (CVE-2024-8176) (GH-131272) (
ba49eab 
GH-131362)

(cherry picked from commit bb0268f)
(cherry picked from commit 6af54d2)

Co-authored-by: Petr Viktorin <encukou@gmail.com>
Co-authored-by: Gregory P. Smith <greg@krypto.org>
ambv pushed a commit that referenced this pull request Apr 3, 2025
@sethmlarson @encukou @gpshead
[3.9] gh-131261: Update libexpat to 2.7.0 (CVE-2024-8176) (GH-131272) (…
8ad2d88 
…GH-131364)

(cherry picked from commit bb0268f)
(cherry picked from commit 6af54d2)

Co-authored-by: Petr Viktorin <encukou@gmail.com>
Co-authored-by: Gregory P. Smith <greg@krypto.org>
@hugovk hugovk removed the needs backport to 3.12 only security fixes label Apr 8, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@encukou encukou encukou approved these changes

@zware zware zware approved these changes

@sethmlarson sethmlarson sethmlarson approved these changes

Assignees

@encukou encukou

Labels

release-blocker type-security A security issue

Projects

Release and Deferred blockers 🚫
Status: Done

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

6 participants

@gpshead @bedevere-bot @encukou @zware @sethmlarson @hugovk