Skip to content

Conversation

sethmlarson
Copy link
Contributor

@sethmlarson sethmlarson commented Feb 15, 2024

Feeding the parser by too small chunks defers parsing to prevent CVE-2023-52425. Future versions of Expat may be more reactive. (cherry picked from commit 4a08e7b)

…ythonGH-115164)

Feeding the parser by too small chunks defers parsing to prevent
CVE-2023-52425. Future versions of Expat may be more reactive.
(cherry picked from commit 4a08e7b)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
@sethmlarson
Copy link
Contributor Author

Marked as release-blocker as it blocks #115474

@sethmlarson sethmlarson requested a review from ambv February 15, 2024 20:26
@ambv ambv merged commit dafb4f0 into python:3.9 Feb 21, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
release-blocker tests Tests in the Lib/test dir type-bug An unexpected behavior, bug, or error
Projects
Development

Successfully merging this pull request may close these issues.

3 participants