[security] CVE-2013-0340 "Billion Laughs" fixed in Expat >=2.4.0: Update vendored copy to expat 2.4.1

[vstinner]

BPO	44394
Nosy	@scoder, @vstinner, @ned-deily, @ambv, @hartwork, @pablogsal, @miss-islington
PRs	bpo-44394: Update libexpat copy to 2.4.1 #26945 [3.10] bpo-44394: Update libexpat copy to 2.4.1 (GH-26945) #28031 [3.9] bpo-44394: Update libexpat copy to 2.4.1 (GH-26945) #28032 [3.8] bpo-44394: Update libexpat copy to 2.4.1 (GH-26945) #28033 [3.7] bpo-44394: Update libexpat copy to 2.4.1 (GH-26945) #28042 [3.6] bpo-44394: Update libexpat copy to 2.4.1 (GH-26945) (GH-28042) #28080 bpo-44394: Ensure libexpat is linked against libm #28617 [3.9] bpo-44394: Ensure libexpat is linked against libm (GH-28617) #28619 [3.8] bpo-44394: Ensure libexpat is linked against libm (GH-28617) #28620 [3.10] bpo-44394: Ensure libexpat is linked against libm (GH-28617) #28621 bpo-44394: [typo] s/libexpact/libexpat/ in setup.py #28624 [3.9] bpo-44394: [typo] s/libexpact/libexpat/ in setup.py (GH-28624) #28627
Files	cpython_rebuild_expat_dir.sh

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = <Date 2021-08-31.07:05:24.142>
created_at = <Date 2021-06-11.14:14:07.254>
labels = ['type-security', '3.8', '3.9', '3.10', '3.11', 'extension-modules', '3.7']
title = '[security] CVE-2013-0340 "Billion Laughs" fixed in Expat >=2.4.0: Update vendored copy to expat 2.4.1'
updated_at = <Date 2022-01-01.17:11:10.030>
user = 'https://github.com/vstinner'

bugs.python.org fields:

activity = <Date 2022-01-01.17:11:10.030>
actor = 'gvanrossum'
assignee = 'none'
closed = True
closed_date = <Date 2021-08-31.07:05:24.142>
closer = 'ned.deily'
components = ['Extension Modules']
creation = <Date 2021-06-11.14:14:07.254>
creator = 'vstinner'
dependencies = []
files = ['50129']
hgrepos = []
issue_num = 44394
keywords = ['patch']
message_count = 20.0
messages = ['395634', '395642', '395649', '396688', '400534', '400537', '400538', '400539', '400547', '400601', '400691', '400694', '400695', '402783', '402797', '402869', '402872', '402875', '402880', '409459']
nosy_count = 7.0
nosy_names = ['scoder', 'vstinner', 'ned.deily', 'lukasz.langa', 'sping', 'pablogsal', 'miss-islington']
pr_nums = ['26945', '28031', '28032', '28033', '28042', '28080', '28617', '28619', '28620', '28621', '28624', '28627']
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'security'
url = 'https://bugs.python.org/issue44394'
versions = ['Python 3.6', 'Python 3.7', 'Python 3.8', 'Python 3.9', 'Python 3.10', 'Python 3.11']

[vstinner]

Our vendored copy of Modules/expat/ should be updated to Expat 2.4.1 to retrieve the fix for the security vulnerabily CVE-2013-0340 "Billion Laughs":
https://blog.hartwork.org/posts/cve-2013-0340-billion-laughs-fixed-in-expat-2-4-0/

The table of vulnerabilities in Python XML parsers should be updated as well:
https://docs.python.org/dev/library/xml.html#xml-vulnerabilities

My outdated notes on Modules/expat/: copy of libexpat

• ./configure --with-system-expat
• Rationale: https://mail.python.org/pipermail/python-dev/2017-June/148287.html
• Used on Windows and macOS, Linux distributions use system libexpat
• Version: search for XML_MAJOR_VERSION in Modules/expat/expat.h
• Script to update it: see attached script to https://bugs.python.org/issue30947
• Recent update: https://bugs.python.org/issue30947
• Python 2.7, 3.3-3.6 use libexpat 2.2.1

https://pythondev.readthedocs.io/files.html

[gvanrossum]

(From PSRT list, Sebastian:)

Please note that the vulnerability fix also added two new functions to
the API that would be great to have xml.parsers.expat expose to the
users for full control. These are:

• XML_SetBillionLaughsAttackProtectionMaximumAmplification and
• XML_SetBillionLaughsAttackProtectionActivationThreshold

Module xml.parsers.expat.errors and its docs also needs 6 new error code
entries to be complete:

/* Added in 2.0. */
38 XML_ERROR_RESERVED_PREFIX_XML
39 XML_ERROR_RESERVED_PREFIX_XMLNS
40 XML_ERROR_RESERVED_NAMESPACE_URI

/* Added in 2.2.1. */
41 XML_ERROR_INVALID_ARGUMENT

/* Added in 2.3.0. */
42 XML_ERROR_NO_BUFFER

/* Added in 2.4.0. */
43 XML_ERROR_AMPLIFICATION_LIMIT_BREACH

With regard to the table of vulnerabilities mentioned in the ticket,
please note that vulnerability "quadratic blowup" is also fixed by

=2.4.0. Personally, I consider it a flavor of Billion Laughs and all
know variations are covered, including that one.

[hartwork]

FTR that^^ Sebastian is me :)