This issue tracker has been migrated to GitHub, and is currently read-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

classification
Title: Please update bundled libexpat to 2.4.4 with security fixes (CVE-2021-45960)
Type: security Stage: resolved
Components: XML Versions: Python 3.11, Python 3.10, Python 3.9, Python 3.8, Python 3.7
process
Status: closed Resolution: fixed
Dependencies: Superseder:
Assigned To: Nosy List: corona10, lukasz.langa, miss-islington, ned.deily, python-dev, sping, thomgree
Priority: normal Keywords: patch

Created on 2022-01-16 16:32 by sping, last changed 2022-04-11 14:59 by admin. This issue is now closed.

Pull Requests
URL Status Linked Edit
PR 31022 merged python-dev, 2022-01-30 13:54
PR 31295 merged miss-islington, 2022-02-12 15:29
PR 31296 merged corona10, 2022-02-12 15:37
PR 31297 merged corona10, 2022-02-12 15:41
PR 31298 merged corona10, 2022-02-12 15:44
Messages (12)
msg410700 - (view) Author: (sping) * Date: 2022-01-16 16:32
Expat 2.4.3 released, includes security fixes
https://blog.hartwork.org/posts/expat-2-4-3-released/

Thank you!

PS: This is similar to bpo-44394 excect now it's 2.4.3.
msg411061 - (view) Author: Ned Deily (ned.deily) * (Python committer) Date: 2022-01-21 00:12
The bundled expat is potentially used by all Python builds, not just Windows or Mac builds.
msg412117 - (view) Author: (sping) * Date: 2022-01-30 00:27
2.4.4 with more security fixes has been released, adjusting the ticket to be about updating to 2.4.4 now.
msg413132 - (view) Author: (sping) * Date: 2022-02-12 14:48
Just to understand, why has Python 3.7 and 3.8 been dropped?  Neither seems to be end-of-life but affected.  Thank you!
msg413133 - (view) Author: Dong-hee Na (corona10) * (Python committer) Date: 2022-02-12 15:30
New changeset 8aaaf7e182e22026c3487a3b86d4d7d4f0f5f778 by Cyril Jouve in branch 'main':
bpo-46400: Update libexpat from 2.4.1 to 2.4.4 (GH-31022)
https://github.com/python/cpython/commit/8aaaf7e182e22026c3487a3b86d4d7d4f0f5f778
msg413457 - (view) Author: Dong-hee Na (corona10) * (Python committer) Date: 2022-02-17 21:58
New changeset cb7551d5663f35c6993f3c6d8e361bc73f1c43d4 by Dong-hee Na in branch '3.10':
bpo-46400: Update libexpat from 2.4.1 to 2.4.4 (GH-31022) (GH-31296)
https://github.com/python/cpython/commit/cb7551d5663f35c6993f3c6d8e361bc73f1c43d4
msg413458 - (view) Author: Dong-hee Na (corona10) * (Python committer) Date: 2022-02-17 21:58
New changeset e7828904f39588dad438c5d341a31e72e9cb1775 by Miss Islington (bot) in branch '3.9':
bpo-46400: Update libexpat from 2.4.1 to 2.4.4 (GH-31022) (GH-31295)
https://github.com/python/cpython/commit/e7828904f39588dad438c5d341a31e72e9cb1775
msg413529 - (view) Author: Ned Deily (ned.deily) * (Python committer) Date: 2022-02-19 04:07
expat 2.4.5 was released today (Issue46794).
msg413550 - (view) Author: (sping) * Date: 2022-02-19 14:44
Yes, I have already created bpo-46794 for 2.4.5.
msg413551 - (view) Author: (sping) * Date: 2022-02-19 14:44
Overlooked your reference, so you already know, my bad, nevermind.
msg413656 - (view) Author: Łukasz Langa (lukasz.langa) * (Python committer) Date: 2022-02-21 15:02
New changeset c60414de7cefd092643ba200c2c045da1569c391 by Dong-hee Na in branch '3.8':
bpo-46400: Update libexpat from 2.4.1 to 2.4.4 (GH-31022) (GH-31297)
https://github.com/python/cpython/commit/c60414de7cefd092643ba200c2c045da1569c391
msg413668 - (view) Author: Ned Deily (ned.deily) * (Python committer) Date: 2022-02-21 18:46
New changeset 5fdacac8cecb123ae12669ceb3504b2f41075c20 by Dong-hee Na in branch '3.7':
bpo-46400: Update libexpat from 2.4.1 to 2.4.4 (GH-31022) (GH-31298)
https://github.com/python/cpython/commit/5fdacac8cecb123ae12669ceb3504b2f41075c20
History
Date User Action Args
2022-04-11 14:59:54adminsetgithub: 90558
2022-02-21 18:47:10ned.deilysetstatus: open -> closed
resolution: fixed
stage: patch review -> resolved
2022-02-21 18:46:10ned.deilysetmessages: + msg413668
2022-02-21 15:02:42lukasz.langasetnosy: + lukasz.langa
messages: + msg413656
2022-02-19 14:44:54spingsetmessages: + msg413551
2022-02-19 14:44:03spingsetmessages: + msg413550
2022-02-19 04:07:31ned.deilysetnosy: + ned.deily
messages: + msg413529
2022-02-17 21:58:29corona10setmessages: + msg413458
2022-02-17 21:58:12corona10setmessages: + msg413457
2022-02-12 15:44:57corona10setpull_requests: + pull_request29457
2022-02-12 15:41:40corona10setpull_requests: + pull_request29456
2022-02-12 15:37:41corona10setnosy: + corona10
pull_requests: + pull_request29455
2022-02-12 15:31:10corona10setnosy: - corona10

versions: + Python 3.7, Python 3.8
2022-02-12 15:30:03corona10setnosy: + corona10
messages: + msg413133
2022-02-12 15:29:52miss-islingtonsetnosy: + miss-islington
pull_requests: + pull_request29454
2022-02-12 14:48:24spingsetmessages: + msg413132
2022-02-12 14:35:54corona10setversions: - Python 3.7, Python 3.8
2022-02-11 02:55:26vstinnersettitle: Please update bundled libexpat to 2.4.4 with security fixes -> Please update bundled libexpat to 2.4.4 with security fixes (CVE-2021-45960)
2022-02-09 14:25:47steve.dowerlinkissue46687 superseder
2022-01-30 13:54:22python-devsetkeywords: + patch
nosy: + python-dev

pull_requests: + pull_request29203
stage: patch review
2022-01-30 00:27:48spingsetmessages: + msg412117
title: Please update bundled libexpat to 2.4.3 with security fixes -> Please update bundled libexpat to 2.4.4 with security fixes
2022-01-21 00:14:18ned.deilysetnosy: - paul.moore, ronaldoussoren, tim.golden, ned.deily, zach.ware, steve.dower
2022-01-21 00:12:55ned.deilysetmessages: + msg411061
2022-01-20 13:31:06kumaradityasetnosy: + paul.moore, ronaldoussoren, tim.golden, ned.deily, zach.ware, steve.dower
2022-01-20 11:36:54thomgreesetnosy: + thomgree
2022-01-16 16:36:33spingsettitle: Please updated bundled libexpat to 2.4.3 with security fixes -> Please update bundled libexpat to 2.4.3 with security fixes
2022-01-16 16:32:40spingcreate