Skip to content

/ cpython

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

closes bpo-38174: Update vendored expat library to 2.2.8. #16346

Merged
merged 1 commit into from Sep 26, 2019
Merged

closes bpo-38174: Update vendored expat library to 2.2.8. #16346

merged 1 commit into from Sep 26, 2019

Conversation

@benjaminp
Copy link
Contributor

benjaminp commented Sep 24, 2019 •
edited by bedevere-bot

Fixes CVE-2019-15903. See full changelog at https://github.com/libexpat/libexpat/blob/R_2_2_8/expat/Changes.

https://bugs.python.org/issue38174
@vstinner
vstinner requested changes Sep 24, 2019
View changes
Copy link
Member

vstinner left a comment

Using my https://github.com/vstinner/misc/blob/master/cpython/cpython_rebuild_expat_dir.sh script (modify TAG= at the first line to put: TAG=R_2_2_8), I get a very similar result, except that my script also removed Modules/expat/loadlibrary.c. loadlibrary.c has been removed from libexpat: libexpat/libexpat@5d34a70

"replace loadlibrary.c and RtlGenRandom call with rand_s() on windows"
@bedevere-bot

This comment has been minimized.

Sign in to view
Copy link

bedevere-bot commented Sep 24, 2019

When you're done making the requested changes, leave the comment: I have made the requested changes; please review again.
@benjaminp benjaminp force-pushed the benjaminp:up-expat branch from 8eb39e4 to e022e1f Sep 25, 2019
@benjaminp

This comment has been minimized.

Sign in to view
Copy link
Contributor Author

benjaminp commented Sep 25, 2019

@bedevere-bot

This comment has been minimized.

Sign in to view
Copy link

bedevere-bot commented Sep 25, 2019

Thanks for making the requested changes!

@vstinner: please review the changes made to this pull request.
@bedevere-bot bedevere-bot requested a review from vstinner Sep 25, 2019
@vstinner
vstinner approved these changes Sep 25, 2019
View changes
Copy link
Member

vstinner left a comment

LGTM, thanks.
@benjaminp
closes bpo-38174: Update vendored expat library to 2.2.8.
Loading status checks…
8664e3a 
Fixes CVE-2019-15903. See full changelog at https://github.com/libexpat/libexpat/blob/R_2_2_8/expat/Changes.
@benjaminp benjaminp force-pushed the benjaminp:up-expat branch from e022e1f to 8664e3a Sep 25, 2019
@benjaminp benjaminp requested a review from python/windows-team as a code owner Sep 25, 2019
@benjaminp benjaminp merged commit 52b9408 into python:master Sep 26, 2019
4 checks passed
4 checks passed
Azure Pipelines PR #20190925.43 succeeded
Details
bedevere/issue-number Issue number 38174 found
Details
bedevere/news News entry found in Misc/NEWS.d
continuous-integration/travis-ci/pr The Travis CI build passed
Details
@benjaminp benjaminp deleted the benjaminp:up-expat branch Sep 26, 2019
@miss-islington

This comment has been minimized.

Sign in to view
Copy link

miss-islington commented Sep 26, 2019

Thanks @benjaminp for the PR 🌮🎉.. I'm working now to backport this PR to: 2.7, 3.6, 3.7, 3.8.
🐍🍒⛏🤖
@miss-islington

This comment has been minimized.

Sign in to view
Copy link

miss-islington commented Sep 26, 2019

I'm having trouble backporting to 3.8. Reason: 'Error 110 while writing to socket. Connection timed out.'. Please retry by removing and re-adding the needs backport to 3.8 label.
@miss-islington

This comment has been minimized.

Sign in to view
Copy link

miss-islington commented Sep 26, 2019

Sorry, @benjaminp, I could not cleanly backport this to 3.7 due to a conflict.
Please backport using cherry_picker on command line.
cherry_picker 52b940803860e37bcc3f6096b2d24e7c20a0e807 3.7
@miss-islington

This comment has been minimized.

Sign in to view
Copy link

miss-islington commented Sep 26, 2019

Sorry @benjaminp, I had trouble checking out the 3.6 backport branch.
Please backport using cherry_picker on command line.
cherry_picker 52b940803860e37bcc3f6096b2d24e7c20a0e807 3.6
@miss-islington

This comment has been minimized.

Sign in to view
Copy link

miss-islington commented Sep 26, 2019

Sorry, @benjaminp, I could not cleanly backport this to 2.7 due to a conflict.
Please backport using cherry_picker on command line.
cherry_picker 52b940803860e37bcc3f6096b2d24e7c20a0e807 2.7
benjaminp added a commit that referenced this pull request Sep 26, 2019
@benjaminp
[3.7] closes bpo-38174: Update vendored expat library to 2.2.8. (GH-1…
Loading status checks…
90af48c 
…6346)

Fixes CVE-2019-15903. See full changelog at https://github.com/libexpat/libexpat/blob/R_2_2_8/expat/Changes..
(cherry picked from commit 52b9408)

Co-authored-by: Benjamin Peterson <benjamin@python.org>
@bedevere-bot

This comment has been minimized.

Sign in to view
Copy link

bedevere-bot commented Sep 26, 2019

GH-16407 is a backport of this pull request to the 3.7 branch.
@miss-islington

This comment has been minimized.

Sign in to view
Copy link

miss-islington commented Sep 26, 2019

Thanks @benjaminp for the PR 🌮🎉.. I'm working now to backport this PR to: 3.8.
🐍🍒⛏🤖
@miss-islington

This comment has been minimized.

Sign in to view
Copy link

miss-islington commented Sep 26, 2019

Sorry @benjaminp, I had trouble checking out the 3.8 backport branch.
Please backport using cherry_picker on command line.
cherry_picker 52b940803860e37bcc3f6096b2d24e7c20a0e807 3.8
benjaminp added a commit that referenced this pull request Sep 26, 2019
@benjaminp
[2.7] closes bpo-38174: Update vendored expat library to 2.2.8. (GH-1…
Loading status checks…
33891a5 
…6346)

Fixes CVE-2019-15903. See full changelog at https://github.com/libexpat/libexpat/blob/R_2_2_8/expat/Changes..
(cherry picked from commit 52b9408)

Co-authored-by: Benjamin Peterson <benjamin@python.org>
@bedevere-bot

This comment has been minimized.

Sign in to view
Copy link

bedevere-bot commented Sep 26, 2019

GH-16408 is a backport of this pull request to the 2.7 branch.
benjaminp added a commit that referenced this pull request Sep 26, 2019
@benjaminp
[3.8] closes bpo-38174: Update vendored expat library to 2.2.8. (GH-1…
Loading status checks…
48c6ef3 
…6346)

Fixes CVE-2019-15903. See full changelog at https://github.com/libexpat/libexpat/blob/R_2_2_8/expat/Changes.
(cherry picked from commit 52b9408)

Co-authored-by: Benjamin Peterson <benjamin@python.org>
@bedevere-bot

This comment has been minimized.

Sign in to view
Copy link

bedevere-bot commented Sep 26, 2019

GH-16409 is a backport of this pull request to the 3.8 branch.
benjaminp added a commit that referenced this pull request Sep 26, 2019
@benjaminp
[3.6] closes bpo-38174: Update vendored expat library to 2.2.8. (GH-1…
Loading status checks…
14cb6fb 
…6346)

Fixes CVE-2019-15903. See full changelog at https://github.com/libexpat/libexpat/blob/R_2_2_8/expat/Changes..
(cherry picked from commit 52b9408)

Co-authored-by: Benjamin Peterson <benjamin@python.org>
@bedevere-bot

This comment has been minimized.

Sign in to view
Copy link

bedevere-bot commented Sep 26, 2019

GH-16410 is a backport of this pull request to the 3.6 branch.
vstinner added a commit to vstinner/cpython that referenced this pull request Sep 27, 2019
@benjaminp @vstinner
closes bpo-38174: Update vendored expat library to 2.2.8. (pythonGH-1…
bc6a438 
…6346)

Fixes CVE-2019-15903. See full changelog at https://github.com/libexpat/libexpat/blob/R_2_2_8/expat/Changes.

(cherry picked from commit 52b9408)
vstinner added a commit to vstinner/cpython that referenced this pull request Oct 8, 2019
@benjaminp @vstinner
closes bpo-38174: Update vendored expat library to 2.2.8. (pythonGH-1…
184340a 
…6346)

Fixes CVE-2019-15903. See full changelog at https://github.com/libexpat/libexpat/blob/R_2_2_8/expat/Changes.

(cherry picked from commit 52b9408)
larryhastings added a commit that referenced this pull request Oct 9, 2019
@vstinner @larryhastings
closes bpo-38174: Update vendored expat library to 2.2.8. (GH-16346) (#…
c386c8b 
…16434)

Fixes CVE-2019-15903. See full changelog at https://github.com/libexpat/libexpat/blob/R_2_2_8/expat/Changes.
jacobneiltaylor added a commit to jacobneiltaylor/cpython that referenced this pull request Dec 5, 2019
@benjaminp @jacobneiltaylor
closes bpo-38174: Update vendored expat library to 2.2.8. (pythonGH-1…
4a27cfe 
…6346)

Fixes CVE-2019-15903. See full changelog at https://github.com/libexpat/libexpat/blob/R_2_2_8/expat/Changes.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@vstinner vstinner

@python/windows-team windows-team

Assignees

@benjaminp benjaminp

Labels
CLA signed
Projects
None yet
Milestone
No milestone
5 participants
@benjaminp @bedevere-bot @miss-islington @vstinner @the-knights-who-say-ni
You can’t perform that action at this time.