Repository navigation
Upgrade our bundled copy of libexpat to the latest (2.4.9?) #97005
Description
There have been important security fixes in libexpat since our update to 2.4.7. Such as one for https://nvd.nist.gov/vuln/detail/CVE-2022-40674.
This likely impacts our binary releases that use our bundled expat libraries (Windows and macOS?) the most. Some OS distro Python packages often link against their own expat package which they've probably already patched.
Activity
gpshead commentedon Sep 22, 2022
I did not look to see if our use of libexpat actually allows the CVE in question to be triggered. If so that suggests we should do this sooner rather than later, but it is good for us to stay up to date in a timely fashion regardless.
corona10 commentedon Sep 22, 2022
cc @hartwork
pythongh-97005: Update libexpat from 2.4.7 to 2.4.9
pythongh-97005: Update libexpat from 2.4.7 to 2.4.9
pythongh-97005: Update libexpat from 2.4.7 to 2.4.9 (pythongh-97006)
gh-97005: Update libexpat from 2.4.7 to 2.4.9 (gh-97006)
pythongh-97005: Update libexpat from 2.4.7 to 2.4.9 (pythongh-97006)
pythongh-97005: Update libexpat from 2.4.7 to 2.4.9 (pythongh-97006)
pythongh-97005: Update libexpat from 2.4.7 to 2.4.9 (pythongh-97006)
pythongh-97005: Update libexpat from 2.4.7 to 2.4.9 (pythongh-97006)
gh-97005: Update libexpat from 2.4.7 to 2.4.9 (gh-97006)
gh-97005: Update libexpat from 2.4.7 to 2.4.9 (gh-97006)
[3.9] gh-97005: Update libexpat from 2.4.7 to 2.4.9 (gh-97006) (gh-97012
[3.8] gh-97005: Update libexpat from 2.4.7 to 2.4.9 (gh-97006) (gh-97013
[3.7] gh-97005: Update libexpat from 2.4.7 to 2.4.9 (gh-97006) (#97014)
corona10 commentedon Oct 6, 2022
We can close this issue now :)