Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

[3.12] gh-90949: add Expat API to prevent XML deadly allocations (CVE-2025-59375) (GH-139234)#139527

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Merged
Yhg1s merged 9 commits intopython:3.12fromhartwork:backport-f04bea4-3.12
Dec 17, 2025

Conversation

@hartwork
Copy link
Contributor

@hartworkhartwork commentedOct 2, 2025•
edited by github-actionsbot
Loading

Expose the XML Expat 2.7.2 mitigation APIs to disallow use of disproportional amounts of dynamic memory from within an Expat parser (seeCVE-2025-59375 for instance).

The exposed APIs are available on Expat parsers, that is, parsers created byxml.parsers.expat.ParserCreate(), as:

  • parser.SetAllocTrackerActivationThreshold(threshold), and
  • parser.SetAllocTrackerMaximumAmplification(max_factor).

(cherry picked from commitf04bea4)

CC@picnixz

📚 Documentation preview 📚:https://cpython-previews--139527.org.readthedocs.build/

picnixzand others added4 commitsOctober 2, 2025 23:47
CVE-2025-59375) (pythonGH-139234)Expose the XML Expat 2.7.2 mitigation APIs to disallow use ofdisproportional amounts of dynamic memory from within an Expatparser (seeCVE-2025-59375 for instance).The exposed APIs are available on Expat parsers, that is,parsers created by `xml.parsers.expat.ParserCreate()`, as:- `parser.SetAllocTrackerActivationThreshold(threshold)`, and- `parser.SetAllocTrackerMaximumAmplification(max_factor)`.(cherry picked from commitf04bea4)Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
…on API (python#139366)Fix some typos left inf04bea4,and simplify some internal functions to ease maintenance of futuremitigation APIs.(cherry picked from commit68a1778)
@picnixz
Copy link
Member

To have a good synchronization, we'll also delay 3.10 to 3.13 backports for their next release cycle (see#139359 (comment)).

@picnixzpicnixz self-assigned thisOct 7, 2025
@ambv
Copy link
Contributor

ambv commentedOct 8, 2025

I set DO-NOT-MERGE to avoid confusion. Unset that when you think we should be releasing this.

Copy link
Member

@picnixzpicnixz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

The 22 additional lines are in the clinic file so all good.

hartwork reacted with thumbs up emoji
@picnixzpicnixz requested review fromYhg1s and removed request forYhg1sNovember 8, 2025 13:47
@hartwork
Copy link
ContributorAuthor

@Yhg1s do you have a minute for this? 🙏

@hartwork
Copy link
ContributorAuthor

@Yhg1s do you have a minute? 🙏

@Yhg1sYhg1s merged commit0e4cd89 intopython:3.12Dec 17, 2025
30 checks passed
@hartwork
Copy link
ContributorAuthor

Thanks! 🙏

Sign up for freeto join this conversation on GitHub. Already have an account?Sign in to comment

Reviewers

@picnixzpicnixzpicnixz approved these changes

Assignees

@Yhg1sYhg1s

@picnixzpicnixz

Labels

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@hartwork@picnixz@ambv@Yhg1s
[8]ページ先頭
©2009-2025 Movatter.jp