[security] CVE-2013-0340 "Billion Laughs" fixed in Expat >=2.4.0: Update vendored copy to expat 2.4.1 #88560

vstinner · 2021-06-11T14:14:07Z

BPO	44394
Nosy	@scoder, @vstinner, @ned-deily, @ambv, @hartwork, @pablogsal, @miss-islington
PRs	bpo-44394: Update libexpat copy to 2.4.1 #26945 [3.10] bpo-44394: Update libexpat copy to 2.4.1 (GH-26945) #28031 [3.9] bpo-44394: Update libexpat copy to 2.4.1 (GH-26945) #28032 [3.8] bpo-44394: Update libexpat copy to 2.4.1 (GH-26945) #28033 [3.7] bpo-44394: Update libexpat copy to 2.4.1 (GH-26945) #28042 [3.6] bpo-44394: Update libexpat copy to 2.4.1 (GH-26945) (GH-28042) #28080 bpo-44394: Ensure libexpat is linked against libm #28617 [3.9] bpo-44394: Ensure libexpat is linked against libm (GH-28617) #28619 [3.8] bpo-44394: Ensure libexpat is linked against libm (GH-28617) #28620 [3.10] bpo-44394: Ensure libexpat is linked against libm (GH-28617) #28621 bpo-44394: [typo] s/libexpact/libexpat/ in setup.py #28624 [3.9] bpo-44394: [typo] s/libexpact/libexpat/ in setup.py (GH-28624) #28627
Files	cpython_rebuild_expat_dir.sh

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = <Date 2021-08-31.07:05:24.142>
created_at = <Date 2021-06-11.14:14:07.254>
labels = ['type-security', '3.8', '3.9', '3.10', '3.11', 'extension-modules', '3.7']
title = '[security] CVE-2013-0340 "Billion Laughs" fixed in Expat >=2.4.0: Update vendored copy to expat 2.4.1'
updated_at = <Date 2022-01-01.17:11:10.030>
user = 'https://github.com/vstinner'

bugs.python.org fields:

activity = <Date 2022-01-01.17:11:10.030>
actor = 'gvanrossum'
assignee = 'none'
closed = True
closed_date = <Date 2021-08-31.07:05:24.142>
closer = 'ned.deily'
components = ['Extension Modules']
creation = <Date 2021-06-11.14:14:07.254>
creator = 'vstinner'
dependencies = []
files = ['50129']
hgrepos = []
issue_num = 44394
keywords = ['patch']
message_count = 20.0
messages = ['395634', '395642', '395649', '396688', '400534', '400537', '400538', '400539', '400547', '400601', '400691', '400694', '400695', '402783', '402797', '402869', '402872', '402875', '402880', '409459']
nosy_count = 7.0
nosy_names = ['scoder', 'vstinner', 'ned.deily', 'lukasz.langa', 'sping', 'pablogsal', 'miss-islington']
pr_nums = ['26945', '28031', '28032', '28033', '28042', '28080', '28617', '28619', '28620', '28621', '28624', '28627']
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'security'
url = 'https://bugs.python.org/issue44394'
versions = ['Python 3.6', 'Python 3.7', 'Python 3.8', 'Python 3.9', 'Python 3.10', 'Python 3.11']

vstinner · 2021-06-11T14:14:07Z

Our vendored copy of Modules/expat/ should be updated to Expat 2.4.1 to retrieve the fix for the security vulnerabily CVE-2013-0340 "Billion Laughs":
https://blog.hartwork.org/posts/cve-2013-0340-billion-laughs-fixed-in-expat-2-4-0/

The table of vulnerabilities in Python XML parsers should be updated as well:
https://docs.python.org/dev/library/xml.html#xml-vulnerabilities

My outdated notes on Modules/expat/: copy of libexpat

./configure --with-system-expat
Rationale: https://mail.python.org/pipermail/python-dev/2017-June/148287.html
Used on Windows and macOS, Linux distributions use system libexpat
Version: search for XML_MAJOR_VERSION in Modules/expat/expat.h
Script to update it: see attached script to https://bugs.python.org/issue30947
Recent update: https://bugs.python.org/issue30947
Python 2.7, 3.3-3.6 use libexpat 2.2.1

https://pythondev.readthedocs.io/files.html

gvanrossum · 2021-06-11T15:46:25Z

(From PSRT list, Sebastian:)

Please note that the vulnerability fix also added two new functions to
the API that would be great to have xml.parsers.expat expose to the
users for full control. These are:

XML_SetBillionLaughsAttackProtectionMaximumAmplification and
XML_SetBillionLaughsAttackProtectionActivationThreshold

Module xml.parsers.expat.errors and its docs also needs 6 new error code
entries to be complete:

/* Added in 2.0. */
38 XML_ERROR_RESERVED_PREFIX_XML
39 XML_ERROR_RESERVED_PREFIX_XMLNS
40 XML_ERROR_RESERVED_NAMESPACE_URI

/* Added in 2.2.1. */
41 XML_ERROR_INVALID_ARGUMENT

/* Added in 2.3.0. */
42 XML_ERROR_NO_BUFFER

/* Added in 2.4.0. */
43 XML_ERROR_AMPLIFICATION_LIMIT_BREACH

With regard to the table of vulnerabilities mentioned in the ticket,
please note that vulnerability "quadratic blowup" is also fixed by

=2.4.0. Personally, I consider it a flavor of Billion Laughs and all
know variations are covered, including that one.

hartwork · 2021-06-11T17:03:53Z

FTR that^^ Sebastian is me :)

vstinner · 2021-06-29T00:57:30Z

Attached cpython_rebuild_expat_dir.sh script updates Modules/expat/ to our libexpat copy to 2.4.1. I used it to create attached PR 26945.

ambv · 2021-08-29T14:08:31Z

New changeset 3fc5d84 by Victor Stinner in branch 'main':
bpo-44394: Update libexpat copy to 2.4.1 (GH-26945)
3fc5d84

ambv · 2021-08-29T14:31:35Z

New changeset c9c2a0b by Miss Islington (bot) in branch '3.8':
bpo-44394: Update libexpat copy to 2.4.1 (GH-26945) (GH-28033)
c9c2a0b

miss-islington · 2021-08-29T14:32:58Z

New changeset 2706785 by Miss Islington (bot) in branch '3.10':
bpo-44394: Update libexpat copy to 2.4.1 (GH-26945)
2706785

ambv · 2021-08-29T14:36:45Z

New changeset 007221a by Miss Islington (bot) in branch '3.9':
bpo-44394: Update libexpat copy to 2.4.1 (GH-26945) (GH-28032)
007221a

ambv · 2021-08-29T15:24:19Z

3.6 will need a separate backport because it's using expat 2.2.6 at the moment (from b2260e5).

3.7 conflicted since it didn't include local changes to the vendored 2.2.8 that were introduced in 3.8+. I fixed that, the backport is up.

vstinner · 2021-08-30T13:39:35Z

I created https://python-security.readthedocs.io/vuln/expat-billion-laughs.html to track this vulnerability.

ned-deily · 2021-08-31T05:12:01Z

New changeset 79101b8 by Łukasz Langa in branch '3.7':
[3.7] bpo-44394: Update libexpat copy to 2.4.1 (GH-26945) (GH-28042)
79101b8

ned-deily · 2021-08-31T06:35:40Z

New changeset 910886a by Ned Deily in branch '3.6':
[3.6] bpo-44394: Update libexpat copy to 2.4.1 (GH-26945) (GH-28042) (GH-28080)
910886a

ned-deily · 2021-08-31T07:05:24Z

PRs merged in 3.7 branch for release in 3.7.12 and in 3.6 branch for release in 3.6.15.

pablogsal · 2021-09-28T15:43:45Z

The backport to 3.8 broke 3.8.12 in AIX:

0/Modules/_decimal/libmpdec/sixstep.o build/temp.aix-7.1-3.8/tmp/python3.8-3.8.12-0/Modules/_decimal/libmpdec/transpose.o -L. -L/opt/bb/lib -L/opt/bb/lib64 -R/opt/bb/lib64 -lm -o build/lib.aix-7.1-3.8/_decimal.cpython-38.so

*** WARNING: renaming "pyexpat" since importing it failed: rtld: 0712-001 Symbol _isnanf was referenced
from module build/lib.aix-7.1-3.8/pyexpat.cpython-38.so(), but a runtime definition of the symbol was not found.

hartwork · 2021-09-28T17:56:52Z

For the AIX link error that Pablo brought up, there is merged pull request libexpat/libexpat#510 upstream.

pablogsal · 2021-09-29T13:18:49Z

New changeset 6c1154b by Pablo Galindo Salgado in branch 'main':
bpo-44394: Ensure libexpat is linked against libm (GH-28617)
6c1154b

miss-islington · 2021-09-29T13:48:03Z

New changeset fafa213 by Miss Islington (bot) in branch '3.9':
bpo-44394: Ensure libexpat is linked against libm (GH-28617)
fafa213

ambv · 2021-09-29T14:13:46Z

New changeset 412ae8a by Miss Islington (bot) in branch '3.10':
[3.10] bpo-44394: Ensure libexpat is linked against libm (GH-28617) (GH-28621)
412ae8a

ambv · 2021-09-29T14:36:03Z

New changeset 90004fc by Miss Islington (bot) in branch '3.8':
[3.8] bpo-44394: Ensure libexpat is linked against libm (GH-28617) (GH-28620)
90004fc

scoder · 2022-01-01T14:27:09Z

I'd like to ask for clarification regarding bpo-45321, which adds the missing error constants to the expat module. I consider those new features – it seems inappropriate to add new module constants in the middle of a release series. However, in this ticket here, the libexpat version was updated all the way back to Py3.6, to solve a security issue.

Should we also backport the error constants then?

vstinner added 3.7 (EOL) end of life 3.8 only security fixes 3.9 only security fixes 3.10 only security fixes 3.11 only security fixes extension-modules C modules in the Modules dir type-security A security issue labels Jun 11, 2021

hartwork mannequin changed the title ~~[security] CVE-2013-0340 "Billion Laughs" fixed in Expat >=2.4.0: Updated to vendoed copy to expat 2.4.1~~ [security] CVE-2013-0340 "Billion Laughs" fixed in Expat >=2.4.0: Update vendored copy to expat 2.4.1 Jun 11, 2021

ned-deily closed this as completed Aug 31, 2021

ezio-melotti transferred this issue from another repository Apr 10, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[security] CVE-2013-0340 "Billion Laughs" fixed in Expat >=2.4.0: Update vendored copy to expat 2.4.1 #88560

[security] CVE-2013-0340 "Billion Laughs" fixed in Expat >=2.4.0: Update vendored copy to expat 2.4.1 #88560

vstinner commented Jun 11, 2021

vstinner commented Jun 11, 2021

gvanrossum commented Jun 11, 2021

hartwork mannequin commented Jun 11, 2021

vstinner commented Jun 29, 2021

ambv commented Aug 29, 2021

ambv commented Aug 29, 2021

miss-islington commented Aug 29, 2021

ambv commented Aug 29, 2021

ambv commented Aug 29, 2021

vstinner commented Aug 30, 2021

ned-deily commented Aug 31, 2021

ned-deily commented Aug 31, 2021

ned-deily commented Aug 31, 2021

pablogsal commented Sep 28, 2021

hartwork mannequin commented Sep 28, 2021

pablogsal commented Sep 29, 2021

miss-islington commented Sep 29, 2021

ambv commented Sep 29, 2021

ambv commented Sep 29, 2021

scoder commented Jan 1, 2022

[security] CVE-2013-0340 "Billion Laughs" fixed in Expat >=2.4.0: Update vendored copy to expat 2.4.1 #88560

[security] CVE-2013-0340 "Billion Laughs" fixed in Expat >=2.4.0: Update vendored copy to expat 2.4.1 #88560

Comments

vstinner commented Jun 11, 2021

vstinner commented Jun 11, 2021

gvanrossum commented Jun 11, 2021

hartwork mannequin commented Jun 11, 2021

vstinner commented Jun 29, 2021

ambv commented Aug 29, 2021

ambv commented Aug 29, 2021

miss-islington commented Aug 29, 2021

ambv commented Aug 29, 2021

ambv commented Aug 29, 2021

vstinner commented Aug 30, 2021

ned-deily commented Aug 31, 2021

ned-deily commented Aug 31, 2021

ned-deily commented Aug 31, 2021

pablogsal commented Sep 28, 2021

hartwork mannequin commented Sep 28, 2021

pablogsal commented Sep 29, 2021

miss-islington commented Sep 29, 2021

ambv commented Sep 29, 2021

ambv commented Sep 29, 2021

scoder commented Jan 1, 2022