New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

gh-115399: Document CVE-2023-52425 under "XML vulnerabilities" #115400

Merged

ambv merged 1 commit into python:main from hartwork:document-cve-2023-52425-under-xml-vulnerabilities

Feb 21, 2024

Contributor

hartwork commented Feb 13, 2024 •

edited by bedevere-app bot

Loading

Loosely related to #115399

A dedicated issue didn't seem needed here, but I can create one, if you consider it needed.

📚 Documentation preview 📚: https://cpython-previews--115400.org.readthedocs.build/

Issue: Please upgrade bundled Expat to 2.6.0 (e.g. for the fix to CVE-2023-52425) #115399

bedevere-app bot added awaiting review docs labels

hartwork mentioned this pull request

Release Expat 2.6.0 libexpat/libexpat#775

Closed

28 tasks

sethmlarson added needs backport to 3.8 needs backport to 3.9 needs backport to 3.10 needs backport to 3.11 needs backport to 3.12 labels

Contributor

sethmlarson commented Feb 14, 2024

@hartwork Looks like CI is failing, the news fragment name appears to not be the correct format?

@ambv I'm not sure if docs changes like this get backported to security-only branches?

Contributor Author

hartwork commented Feb 14, 2024 •

edited

Loading

@hartwork Looks like CI is failing, the news fragment name appears to not be the correct format?

@sethmlarson yes, I I wish I knew what the correct file naming is for when there is no GitHub issue, that case seems to be undocumented or hard to find. Any ideas how to rename the file or where to find the related blurp docs? Googling for e.g. "blurp without github issue" doesn't get me anyhere.

@ambv I'm not sure if docs changes like this get backported to security-only branches?

If I may add: this docs extension is security related. Please take my vote for backporting to security-only branches (unless I am missing good reasons not to). If it ends up producing merge conflicts, I can see if I can help with resolving them if reasonably economic. Thanks!

Contributor

sethmlarson commented Feb 14, 2024

@hartwork The tool is "blurb" I think, also you can use #115399 for the GitHub issue.

Contributor Author

hartwork commented Feb 14, 2024

you can use #115399 for the GitHub issue.

@sethmlarson good idea, give me a second…


          Doc/library/xml.rst: Document CVE-2023-52425 under "XML vulnerabilities"

3021d11

hartwork force-pushed the document-cve-2023-52425-under-xml-vulnerabilities branch from 0b5365b to 3021d11 Compare

February 14, 2024 19:17

hartwork changed the title ~~Doc/library/xml.rst: Document CVE-2023-52425 under "XML vulnerabilities"~~ gh-115399: Document CVE-2023-52425 under "XML vulnerabilities"

bedevere-app bot mentioned this pull request

Please upgrade bundled Expat to 2.6.0 (e.g. for the fix to CVE-2023-52425) #115399

Closed

ambv merged commit fbd40ce into python:main

23 checks passed

bedevere-app bot removed the awaiting review label

miss-islington-app bot commented Feb 21, 2024

Thanks @hartwork for the PR, and @ambv for merging it 🌮🎉.. I'm working now to backport this PR to: 3.8, 3.9, 3.10, 3.11, 3.12.
🐍🍒⛏🤖

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request


          pythongh-115399: Document CVE-2023-52425 under "XML vulnerabilities" (p…

0873ae7

…ythonGH-115400)

Doc/library/xml.rst: Document CVE-2023-52425 under "XML vulnerabilities"
(cherry picked from commit fbd40ce)

Co-authored-by: Sebastian Pipping <sebastian@pipping.org>

bedevere-app bot commented Feb 21, 2024

GH-115760 is a backport of this pull request to the 3.12 branch.

bedevere-app bot removed the needs backport to 3.12 label

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request


          pythongh-115399: Document CVE-2023-52425 under "XML vulnerabilities" (p…

d80a4cf

…ythonGH-115400)

Doc/library/xml.rst: Document CVE-2023-52425 under "XML vulnerabilities"
(cherry picked from commit fbd40ce)

Co-authored-by: Sebastian Pipping <sebastian@pipping.org>

bedevere-app bot commented Feb 21, 2024

GH-115761 is a backport of this pull request to the 3.11 branch.

bedevere-app bot removed the needs backport to 3.11 label

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request


          pythongh-115399: Document CVE-2023-52425 under "XML vulnerabilities" (p…

af23c8c

…ythonGH-115400)

Doc/library/xml.rst: Document CVE-2023-52425 under "XML vulnerabilities"
(cherry picked from commit fbd40ce)

Co-authored-by: Sebastian Pipping <sebastian@pipping.org>

bedevere-app bot commented Feb 21, 2024

GH-115762 is a backport of this pull request to the 3.10 branch.

bedevere-app bot removed the needs backport to 3.10 label

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request


          pythongh-115399: Document CVE-2023-52425 under "XML vulnerabilities" (p…

d5fd04b

…ythonGH-115400)

Doc/library/xml.rst: Document CVE-2023-52425 under "XML vulnerabilities"
(cherry picked from commit fbd40ce)

Co-authored-by: Sebastian Pipping <sebastian@pipping.org>

bedevere-app bot commented Feb 21, 2024

GH-115763 is a backport of this pull request to the 3.9 branch.

bedevere-app bot removed the needs backport to 3.9 label

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request


          pythongh-115399: Document CVE-2023-52425 under "XML vulnerabilities" (p…

bd8c826

…ythonGH-115400)

Doc/library/xml.rst: Document CVE-2023-52425 under "XML vulnerabilities"
(cherry picked from commit fbd40ce)

Co-authored-by: Sebastian Pipping <sebastian@pipping.org>

bedevere-app bot commented Feb 21, 2024

GH-115764 is a backport of this pull request to the 3.8 branch.

bedevere-app bot removed the needs backport to 3.8 label

ambv pushed a commit that referenced this pull request


          [3.12] gh-115399: Document CVE-2023-52425 under "XML vulnerabilities" (…

cab8d07

…GH-115400) (GH-115760)

Doc/library/xml.rst: Document CVE-2023-52425 under "XML vulnerabilities"
(cherry picked from commit fbd40ce)

Co-authored-by: Sebastian Pipping <sebastian@pipping.org>

ambv pushed a commit that referenced this pull request


          [3.11] gh-115399: Document CVE-2023-52425 under "XML vulnerabilities" (…

6928d5e

…GH-115400) (GH-115761)

Doc/library/xml.rst: Document CVE-2023-52425 under "XML vulnerabilities"
(cherry picked from commit fbd40ce)

Co-authored-by: Sebastian Pipping <sebastian@pipping.org>

ambv pushed a commit that referenced this pull request


          [3.10] gh-115399: Document CVE-2023-52425 under "XML vulnerabilities" (…

b612ec6

…GH-115400) (GH-115762)

Doc/library/xml.rst: Document CVE-2023-52425 under "XML vulnerabilities"
(cherry picked from commit fbd40ce)

Co-authored-by: Sebastian Pipping <sebastian@pipping.org>

ambv pushed a commit that referenced this pull request


          [3.8] gh-115399: Document CVE-2023-52425 under "XML vulnerabilities" (G…

1e7f79a

…H-115400) (GH-115764)

Doc/library/xml.rst: Document CVE-2023-52425 under "XML vulnerabilities"
(cherry picked from commit fbd40ce)

Co-authored-by: Sebastian Pipping <sebastian@pipping.org>

ambv pushed a commit that referenced this pull request


          [3.9] gh-115399: Document CVE-2023-52425 under "XML vulnerabilities" (G…

…H-115400) (GH-115763)

Doc/library/xml.rst: Document CVE-2023-52425 under "XML vulnerabilities"
(cherry picked from commit fbd40ce)

Co-authored-by: Sebastian Pipping <sebastian@pipping.org>

woodruffw pushed a commit to woodruffw-forks/cpython that referenced this pull request


          pythongh-115399: Document CVE-2023-52425 under "XML vulnerabilities" (p…

1aae53b

…ythonGH-115400)

Doc/library/xml.rst: Document CVE-2023-52425 under "XML vulnerabilities"

diegorusso pushed a commit to diegorusso/cpython that referenced this pull request


          pythongh-115399: Document CVE-2023-52425 under "XML vulnerabilities" (p…

46450e5

…ythonGH-115400)

Doc/library/xml.rst: Document CVE-2023-52425 under "XML vulnerabilities"

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

docs