Skip to content

[3.5] bpo-34623: Use XML_SetHashSalt in _elementtree #9933

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Feb 25, 2019

Conversation

stratakis
Copy link
Contributor

@stratakis stratakis commented Oct 17, 2018

miss-islington and others added 2 commits October 17, 2018 18:22
The C accelerated _elementtree module now initializes hash randomization
salt from _Py_HashSecret instead of libexpat's default CPRNG.

Signed-off-by: Christian Heimes <[email protected]>

https://bugs.python.org/issue34623
(cherry picked from commit cb5778f)

Co-authored-by: Christian Heimes <[email protected]>
@stratakis stratakis changed the title bpo-34623: Use XML_SetHashSalt in _elementtree [3.5]bpo-34623: Use XML_SetHashSalt in _elementtree Oct 17, 2018
@stratakis stratakis changed the title [3.5]bpo-34623: Use XML_SetHashSalt in _elementtree [3.5] bpo-34623: Use XML_SetHashSalt in _elementtree Oct 17, 2018
Copy link
Member

@vstinner vstinner left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.

@tiran: Would you mind to review it as well?

@vstinner
Copy link
Member

@larryhastings: Hi Larry, would you mind to merge this security fix?

@larryhastings larryhastings merged commit 41b48e7 into python:3.5 Feb 25, 2019
@bedevere-bot
Copy link

@larryhastings: Please replace # with GH- in the commit message next time. Thanks!

@larryhastings
Copy link
Contributor

Thanks for the backported fix!

@stratakis stratakis deleted the xml branch June 18, 2020 13:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
type-security A security issue
Projects
None yet
Development

Successfully merging this pull request may close these issues.

7 participants