diff options
| author |   Miss Skeleton (bot) <31488909+miss-islington@users.noreply.github.com> | 2020-10-19 21:38:30 -0700 |
|---|---|---|
| committer |   GitHub <noreply@github.com> | 2020-10-20 00:38:30 -0400 |
| commit | a158fb9c5138db94adf24fbc5690467cda811163 (patch) | |
| tree | eb519c962b5f50a0600e4db9150d8db94595b437 /Misc/NEWS.d/next/Security | |
| parent | Disable macOS CI tests in azure-pipelines (GH-22639) (diff) | |
| download | cpython-a158fb9c5138db94adf24fbc5690467cda811163.tar.gz cpython-a158fb9c5138db94adf24fbc5690467cda811163.tar.bz2 cpython-a158fb9c5138db94adf24fbc5690467cda811163.zip | |
bpo-42051: Reject XML entity declarations in plist files (GH-22760) (GH-22801) (GH-22804)
Co-authored-by: Ronald Oussoren <ronaldoussoren@mac.com>
(cherry picked from commit e512bc799e3864fe3b1351757261762d63471efc)
Co-authored-by: Ned Deily <nad@python.org>
Diffstat (limited to 'Misc/NEWS.d/next/Security')
| -rw-r--r-- | Misc/NEWS.d/next/Security/2020-10-19-10-56-27.bpo-42051.EU_B7u.rst | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/Misc/NEWS.d/next/Security/2020-10-19-10-56-27.bpo-42051.EU_B7u.rst b/Misc/NEWS.d/next/Security/2020-10-19-10-56-27.bpo-42051.EU_B7u.rst new file mode 100644 index 00000000000..e865ed12a03 --- /dev/null +++ b/Misc/NEWS.d/next/Security/2020-10-19-10-56-27.bpo-42051.EU_B7u.rst @@ -0,0 +1,3 @@ +The :mod:`plistlib` module no longer accepts entity declarations in XML +plist files to avoid XML vulnerabilities. This should not affect users as +entity declarations are not used in regular plist files. |