➜

This issue tracker has been migrated to GitHub, and is currently read-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

Author vstinner
Recipients Duy Phan Thanh, vstinner
Date 2017-06-09.09:29:13
SpamBayes Score -1.0
Marked as misclassified Yes
Message-id <1497000553.71.0.674422330477.issue30610@psf.upfronthosting.co.za>
In-reply-to
Content 
What is the first expat version which isn't vulnerable?

I guess that this issue only impacts platforms which don't use --with-system-expat. Linux distributions use the system expat library for example.

Currently, the Python master branch embeds a copy of expat 2.1.1:

Modules/expat/expat.h
#define XML_MAJOR_VERSION 2
#define XML_MINOR_VERSION 1
#define XML_MICRO_VERSION 1
History
Date User Action Args
2017-06-09 09:29:13vstinnersetrecipients: + vstinner, Duy Phan Thanh
2017-06-09 09:29:13vstinnersetmessageid: <1497000553.71.0.674422330477.issue30610@psf.upfronthosting.co.za>
2017-06-09 09:29:13vstinnerlinkissue30610 messages
2017-06-09 09:29:13vstinnercreate