The pyexpat module calls XML_SetHashSalt(self->itself,                   (unsigned long)_Py_HashSecret.expat.hashsalt) to initialize the salt for hash randomization of the XML_Parser struct. The _elementree C accelerator doesn't call XML_SetHashSalt().It's not a security issue with recent versions of libexpat. The library initializes the salt from a good entry source by default.

Note we compile expat with -DXML_POOR_ENTROPY on the assumption that Python always initializes the entropy itself.

> Note we compile expat with -DXML_POOR_ENTROPY on the assumption that Python always initializes the entropy itself.Oh. I forgot this thing. So it seems like we have to backport this change to 2.7, 3.6 and newer versions.What about Python 3.4 and 3.5? Python 3.5 has a copy of libexpat 2.2.0, but setup.py doesn't build expat with XML_POOR_ENTROPY=1.

Dang, it's a security bug after all. :(3.5 has 2.2.4, so it's fine. 2.2.2 had a bug in salt initialization.

New changesetcb5778f00ce48631c7140f33ba242496aaf7102b by Miss Islington (bot) (Christian Heimes) in branch 'master':bpo-34623: Use XML_SetHashSalt in _elementtree (GH-9146)https://github.com/python/cpython/commit/cb5778f00ce48631c7140f33ba242496aaf7102b

Since it's a security fix, the change should land in 3.4 and 3.5, too.

New changeset470a435f3b42c9be5fdb7f7b04f3df5663ba7305 by Miss Islington (bot) in branch '3.7':bpo-34623: Use XML_SetHashSalt in _elementtree (GH-9146)https://github.com/python/cpython/commit/470a435f3b42c9be5fdb7f7b04f3df5663ba7305

New changeset18b20bad75b4ff0486940fba4ec680e96e70f3a2 by Miss Islington (bot) (Christian Heimes) in branch '2.7':[2.7]bpo-34623: Use XML_SetHashSalt in _elementtree (GH-9146) (GH-9394)https://github.com/python/cpython/commit/18b20bad75b4ff0486940fba4ec680e96e70f3a2

New changesetf7666e828cc3d5873136473ea36ba2013d624fa1 by Miss Islington (bot) in branch '3.6':bpo-34623: Use XML_SetHashSalt in _elementtree (GH-9146)https://github.com/python/cpython/commit/f7666e828cc3d5873136473ea36ba2013d624fa1

The bug affects multiple platforms. libexpat's expat.h uses slightly different autoconf macro names than pyconfig.h. Therefore only platforms that have either HAVE_GETRANDOM or _WIN32 defined, use a proper CSPRNG to seed the hash salt.Since HAVE_SYSCALL_GETRANDOM, HAVE_ARC4RANDOM_BUF, HAVE_ARC4RANDOM, or XML_DEV_URANDOM are never defined by Python's pyconfig.h, older Linux platforms, any BSD, and any other Unix platform with /dev/urandom fall back to a weak Mersenne Twister-like RNG with gettimeofday().tv_usec and getpid() as seed.

I have contected Red Hat product security to request a CVE for the issue.

CVE-2018-14647 was assigned to this issue.

New changeset026337a7101369297c8083047d2f3c6fc9dd1e2b by Miss Islington (bot) (Christian Heimes) in branch 'master':bpo-34623: Mention CVE-2018-14647 in news entry (GH-9482)https://github.com/python/cpython/commit/026337a7101369297c8083047d2f3c6fc9dd1e2b

New changeset10be1d3f802b874914b2a13eb41407c7a582d9b3 by Miss Islington (bot) in branch '2.7':[2.7]bpo-34623: Mention CVE-2018-14647 in news entry (GH-9482) (GH-9490)https://github.com/python/cpython/commit/10be1d3f802b874914b2a13eb41407c7a582d9b3

New changesetd1b336e530472f316b1d164d04626724c83b16d7 by Miss Islington (bot) in branch '3.6':[3.6]bpo-34623: Mention CVE-2018-14647 in news entry (GH-9482) (GH-9489)https://github.com/python/cpython/commit/d1b336e530472f316b1d164d04626724c83b16d7

New changeset5c3d8b2efda1b99abe09ad925f366c5695bd66fb by Miss Islington (bot) in branch '3.7':[3.7]bpo-34623: Mention CVE-2018-14647 in news entry (GH-9482) (GH-9488)https://github.com/python/cpython/commit/5c3d8b2efda1b99abe09ad925f366c5695bd66fb

Will this change be backported to 3.5 and 3.4? It applied cleanly on both however on 3.4 there is a test failure:======================================================================ERROR: test_del_attribute (test.test_xml_etree_c.MiscTests)----------------------------------------------------------------------Traceback (most recent call last):  File "/builddir/build/BUILD/Python-3.4.9/Lib/test/test_xml_etree_c.py", line 26, in test_del_attribute    element = cET.Element('tag')AttributeError: 'NoneType' object has no attribute 'Element'----------------------------------------------------------------------

> Will this change be backported to 3.5 and 3.4? It applied cleanly on both however on 3.4 there is a test failure:It actually haven't applied cleanly to me on Python 3.4.6 (SLE-12 package). Apparently self->parser has to be changed into self_xp->parser. Then all tests passed for me.If any Linux maintainer wants to take this patch.

New changesetd16eaf36795da48b930b80b20d3805bc27820712 by larryhastings (stratakis) in branch '3.4':[3.4]bpo-34623: Use XML_SetHashSalt in _elementtree (#9953)https://github.com/python/cpython/commit/d16eaf36795da48b930b80b20d3805bc27820712

New changeset41b48e71ac8a71f56694b548f118bd20ce203410 by larryhastings (stratakis) in branch '3.5':[3.5]bpo-34623: Use XML_SetHashSalt in _elementtree (#9933)https://github.com/python/cpython/commit/41b48e71ac8a71f56694b548f118bd20ce203410