closes bpo-38174: Update vendored expat library to 2.2.8. #16346

benjaminp · 2019-09-24T04:03:25Z

Fixes CVE-2019-15903. See full changelog at https://github.com/libexpat/libexpat/blob/R_2_2_8/expat/Changes.

https://bugs.python.org/issue38174

vstinner

Using my https://github.com/vstinner/misc/blob/master/cpython/cpython_rebuild_expat_dir.sh script (modify TAG= at the first line to put: TAG=R_2_2_8), I get a very similar result, except that my script also removed Modules/expat/loadlibrary.c. loadlibrary.c has been removed from libexpat: libexpat/libexpat@5d34a70

"replace loadlibrary.c and RtlGenRandom call with rand_s() on windows"

bedevere-bot · 2019-09-24T10:16:48Z

When you're done making the requested changes, leave the comment: I have made the requested changes; please review again.

benjaminp · 2019-09-25T06:14:49Z

I have made the requested changes; please review again.

…

On Tue, Sep 24, 2019, at 03:18, Victor Stinner wrote: ***@***.**** requested changes on this pull request. Using my https://github.com/vstinner/misc/blob/master/cpython/cpython_rebuild_expat_dir.sh script (modify TAG= at the first line to put: TAG=R_2_2_8), I get a very similar result, except that my script also removed Modules/expat/loadlibrary.c. loadlibrary.c has been removed from libexpat: ***@***.*** <libexpat/libexpat@5d34a70> "replace loadlibrary.c and RtlGenRandom call with rand_s() on windows" — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#16346?email_source=notifications&email_token=AABVSTSGWWLMHIEESA2U6JDQLHSNTA5CNFSM4IZ2KYIKYY3PNVWWK3TUL52HS4DFWFIHK3DMKJSXC5LFON2FEZLWNFSXPKTDN5WW2ZLOORPWSZGOCFWGI4I#pullrequestreview-292316273>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AABVSTVTJVMOFVGL6FHT7ELQLHSNTANCNFSM4IZ2KYIA>.

bedevere-bot · 2019-09-25T06:14:52Z

Thanks for making the requested changes!

@vstinner: please review the changes made to this pull request.

vstinner

LGTM, thanks.


        closes bpo-38174: Update vendored expat library to 2.2.8.

Fixes CVE-2019-15903. See full changelog at https://github.com/libexpat/libexpat/blob/R_2_2_8/expat/Changes.

miss-islington · 2019-09-26T04:34:01Z

Thanks @benjaminp for the PR 🌮🎉.. I'm working now to backport this PR to: 2.7, 3.6, 3.7, 3.8.
🐍🍒⛏🤖

miss-islington · 2019-09-26T04:34:02Z

I'm having trouble backporting to 3.8. Reason: 'Error 110 while writing to socket. Connection timed out.'. Please retry by removing and re-adding the needs backport to 3.8 label.

miss-islington · 2019-09-26T04:34:10Z

Sorry, @benjaminp, I could not cleanly backport this to 3.7 due to a conflict.
Please backport using cherry_picker on command line.
cherry_picker 52b940803860e37bcc3f6096b2d24e7c20a0e807 3.7

miss-islington · 2019-09-26T04:34:11Z

Sorry @benjaminp, I had trouble checking out the 3.6 backport branch.
Please backport using cherry_picker on command line.
cherry_picker 52b940803860e37bcc3f6096b2d24e7c20a0e807 3.6

miss-islington · 2019-09-26T04:34:15Z

Sorry, @benjaminp, I could not cleanly backport this to 2.7 due to a conflict.
Please backport using cherry_picker on command line.
cherry_picker 52b940803860e37bcc3f6096b2d24e7c20a0e807 2.7


        [3.7] closes bpo-38174: Update vendored expat library to 2.2.8. (GH-1…

…6346) Fixes CVE-2019-15903. See full changelog at https://github.com/libexpat/libexpat/blob/R_2_2_8/expat/Changes.. (cherry picked from commit 52b9408) Co-authored-by: Benjamin Peterson <benjamin@python.org>

bedevere-bot · 2019-09-26T04:35:38Z

GH-16407 is a backport of this pull request to the 3.7 branch.

miss-islington · 2019-09-26T04:35:51Z

Thanks @benjaminp for the PR 🌮🎉.. I'm working now to backport this PR to: 3.8.
🐍🍒⛏🤖

miss-islington · 2019-09-26T04:35:54Z

Sorry @benjaminp, I had trouble checking out the 3.8 backport branch.
Please backport using cherry_picker on command line.
cherry_picker 52b940803860e37bcc3f6096b2d24e7c20a0e807 3.8


        [2.7] closes bpo-38174: Update vendored expat library to 2.2.8. (GH-1…

…6346) Fixes CVE-2019-15903. See full changelog at https://github.com/libexpat/libexpat/blob/R_2_2_8/expat/Changes.. (cherry picked from commit 52b9408) Co-authored-by: Benjamin Peterson <benjamin@python.org>

bedevere-bot · 2019-09-26T04:37:24Z

GH-16408 is a backport of this pull request to the 2.7 branch.


        [3.8] closes bpo-38174: Update vendored expat library to 2.2.8. (GH-1…

…6346) Fixes CVE-2019-15903. See full changelog at https://github.com/libexpat/libexpat/blob/R_2_2_8/expat/Changes. (cherry picked from commit 52b9408) Co-authored-by: Benjamin Peterson <benjamin@python.org>

bedevere-bot · 2019-09-26T04:38:05Z

GH-16409 is a backport of this pull request to the 3.8 branch.


        [3.6] closes bpo-38174: Update vendored expat library to 2.2.8. (GH-1…

…6346) Fixes CVE-2019-15903. See full changelog at https://github.com/libexpat/libexpat/blob/R_2_2_8/expat/Changes.. (cherry picked from commit 52b9408) Co-authored-by: Benjamin Peterson <benjamin@python.org>

bedevere-bot · 2019-09-26T04:39:02Z

GH-16410 is a backport of this pull request to the 3.6 branch.


        closes bpo-38174: Update vendored expat library to 2.2.8. (pythonGH-1…

…6346) Fixes CVE-2019-15903. See full changelog at https://github.com/libexpat/libexpat/blob/R_2_2_8/expat/Changes. (cherry picked from commit 52b9408)


        closes bpo-38174: Update vendored expat library to 2.2.8. (pythonGH-1…

…6346) Fixes CVE-2019-15903. See full changelog at https://github.com/libexpat/libexpat/blob/R_2_2_8/expat/Changes. (cherry picked from commit 52b9408)


        closes bpo-38174: Update vendored expat library to 2.2.8. (GH-16346) (#…

…16434) Fixes CVE-2019-15903. See full changelog at https://github.com/libexpat/libexpat/blob/R_2_2_8/expat/Changes.


        closes bpo-38174: Update vendored expat library to 2.2.8. (pythonGH-1…

…6346) Fixes CVE-2019-15903. See full changelog at https://github.com/libexpat/libexpat/blob/R_2_2_8/expat/Changes.

benjaminp added needs backport to 3.6 needs backport to 2.7 needs backport to 3.7 needs backport to 3.8 labels Sep 24, 2019

the-knights-who-say-ni added the CLA signed label Sep 24, 2019

bedevere-bot added the awaiting core review label Sep 24, 2019

vstinner requested changes Sep 24, 2019

View changes

bedevere-bot added awaiting changes and removed awaiting core review labels Sep 24, 2019

benjaminp force-pushed the benjaminp:up-expat branch from 8eb39e4 to e022e1f Sep 25, 2019

bedevere-bot added awaiting change review and removed awaiting changes labels Sep 25, 2019

bedevere-bot requested a review from vstinner Sep 25, 2019

vstinner approved these changes Sep 25, 2019

View changes

bedevere-bot added awaiting merge and removed awaiting change review labels Sep 25, 2019

closes bpo-38174: Update vendored expat library to 2.2.8.

Loading status checks…

8664e3a

Fixes CVE-2019-15903. See full changelog at https://github.com/libexpat/libexpat/blob/R_2_2_8/expat/Changes.

benjaminp force-pushed the benjaminp:up-expat branch from e022e1f to 8664e3a Sep 25, 2019

benjaminp requested a review from python/windows-team as a code owner Sep 25, 2019

benjaminp deleted the benjaminp:up-expat branch Sep 26, 2019

bedevere-bot removed the awaiting merge label Sep 26, 2019

miss-islington assigned benjaminp Sep 26, 2019

benjaminp removed the needs backport to 3.8 label Sep 26, 2019

bedevere-bot removed the needs backport to 3.7 label Sep 26, 2019

benjaminp added the needs backport to 3.8 label Sep 26, 2019

bedevere-bot removed the needs backport to 2.7 label Sep 26, 2019

bedevere-bot removed the needs backport to 3.8 label Sep 26, 2019

bedevere-bot removed the needs backport to 3.6 label Sep 26, 2019

larryhastings added a commit that referenced this pull request Oct 9, 2019

closes bpo-38174: Update vendored expat library to 2.2.8. (GH-16346) (#…

c386c8b

…16434) Fixes CVE-2019-15903. See full changelog at https://github.com/libexpat/libexpat/blob/R_2_2_8/expat/Changes.

python / cpython

closes bpo-38174: Update vendored expat library to 2.2.8. #16346

closes bpo-38174: Update vendored expat library to 2.2.8. #16346

benjaminp commented Sep 24, 2019 •

edited by bedevere-bot

vstinner left a comment

This comment has been minimized.

bedevere-bot commented Sep 24, 2019

This comment has been minimized.

benjaminp commented Sep 25, 2019

This comment has been minimized.

bedevere-bot commented Sep 25, 2019

vstinner left a comment

This comment has been minimized.

miss-islington commented Sep 26, 2019

This comment has been minimized.

miss-islington commented Sep 26, 2019

This comment has been minimized.

miss-islington commented Sep 26, 2019

This comment has been minimized.

miss-islington commented Sep 26, 2019

This comment has been minimized.

miss-islington commented Sep 26, 2019

This comment has been minimized.

bedevere-bot commented Sep 26, 2019

This comment has been minimized.

miss-islington commented Sep 26, 2019

This comment has been minimized.

miss-islington commented Sep 26, 2019

This comment has been minimized.

bedevere-bot commented Sep 26, 2019

This comment has been minimized.

bedevere-bot commented Sep 26, 2019

This comment has been minimized.

bedevere-bot commented Sep 26, 2019

python / cpython

Sponsor python/cpython

Join GitHub today

closes bpo-38174: Update vendored expat library to 2.2.8. #16346

closes bpo-38174: Update vendored expat library to 2.2.8. #16346

Conversation

benjaminp commented Sep 24, 2019 • edited by bedevere-bot

vstinner left a comment

This comment has been minimized.

bedevere-bot commented Sep 24, 2019

This comment has been minimized.

benjaminp commented Sep 25, 2019

This comment has been minimized.

bedevere-bot commented Sep 25, 2019

vstinner left a comment

This comment has been minimized.

miss-islington commented Sep 26, 2019

This comment has been minimized.

miss-islington commented Sep 26, 2019

This comment has been minimized.

miss-islington commented Sep 26, 2019

This comment has been minimized.

miss-islington commented Sep 26, 2019

This comment has been minimized.

miss-islington commented Sep 26, 2019

This comment has been minimized.

bedevere-bot commented Sep 26, 2019

This comment has been minimized.

miss-islington commented Sep 26, 2019

This comment has been minimized.

miss-islington commented Sep 26, 2019

This comment has been minimized.

bedevere-bot commented Sep 26, 2019

This comment has been minimized.

bedevere-bot commented Sep 26, 2019

This comment has been minimized.

bedevere-bot commented Sep 26, 2019

benjaminp commented Sep 24, 2019 •

edited by bedevere-bot