Document new CVE-2023-52425 Expat API (reparse deferral)

python · Feb 18, 2024 · 850e46d · 850e46d
1 parent b737f03
commit 850e46d
Showing 1 changed file with 8 additions and 0 deletions.
diff --git a/Misc/NEWS.d/next/Security/2024-02-18-03-14-40.gh-issue-115398.tzvxH8.rst b/Misc/NEWS.d/next/Security/2024-02-18-03-14-40.gh-issue-115398.tzvxH8.rst
@@ -0,0 +1,8 @@
+Allow controlling Expat >=2.6.0 reparse deferral (CVE-2023-52425) by adding
+five new methods:
+
+* ``pyexpat.xmlparser.GetReparseDeferralEnabled``
+* ``pyexpat.xmlparser.SetReparseDeferralEnabled``
+* ``xml.etree.ElementTree.XMLParser.flush``
+* ``xml.etree.ElementTree.XMLPullParser.flush``
+* ``xml.sax.expatreader.ExpatParser.flush``