#1006317 Namespace separator ':' incompatible with Expat >=2.4.5 security fixes

Package:
src:python-xmltodict
Source:
python-xmltodict
Submitter:
Valentin Lorentz
Date:
2022-03-13 15:24:07 UTC
Severity:
normal
Tags:
#1006317#5
Date:
2022-02-23 11:47:58 UTC
From:
To:
Dear maintainers,

Since yesterday's upgrade of libexpat1 from 2.2.10-2+deb11u1 to
2.2.10-2+deb11u2, using xml.parsers.expat causes the fallowing error:

 >>> from xml.parsers import expat
 >>> parser = expat.ParserCreate(namespace_separator=':')
 >>> parser.Parse('<foo></foo>', True)
Traceback (most recent call last):
   File "<stdin>", line 1, in <module>
xml.parsers.expat.ExpatError: out of memory: line 1, column 0


This causes at least python3-xmltodict to break when used with the
process_namespaces=True option.

Same issue on Ubuntu's bugtracker:
https://bugs.launchpad.net/ubuntu/+source/python-xmltodict/+bug/1961800


Thank you,
Valentin Lorentz
#1006317#10
Date:
2022-02-24 07:03:51 UTC
From:
To:
Hi Valentin,

My understanding here would be that this uncovered an issue actually
in the application using : as a namespace separator. I'm nevertheless
looping here first the upstream maintainer.

A similar issue was in libwbxml for instance.

Regards,
Salvatore
#1006317#15
Date:
2022-02-24 18:06:32 UTC
From:
To:
Hi everyone,

please see
https://github.com/libexpat/libexpat/issues/572#issuecomment-1050119036
for an in-depth analysis.

Best, Sebastian
#1006317#32
Date:
2022-03-13 15:21:22 UTC
From:
To:
Hi all,

An update for expat (landed in unstable earlier) and now as DSA 5085-2
for buster and bullseye as well is released which relaxes the fix for
CVE-2022-25236 with regard to RFC 3986 URI characters.

So there is no immediate action for updating the affected packages
from regressions ins buster and bulleye. For unstable (and bookworm)
given the API docs of function XML_ParserCreateNS do advise against
using URI characters in namespace searators and expat might be
stricter in future about their use, it's still recomended to address
these isses (I see biboumi in fact did already in #1006333, thanks
Jonas, Slavko and Diane).

Regards,
Salvatore
#1006317#35
Date:
2022-03-13 15:21:22 UTC
From:
To:
Hi all,

An update for expat (landed in unstable earlier) and now as DSA 5085-2
for buster and bullseye as well is released which relaxes the fix for
CVE-2022-25236 with regard to RFC 3986 URI characters.

So there is no immediate action for updating the affected packages
from regressions ins buster and bulleye. For unstable (and bookworm)
given the API docs of function XML_ParserCreateNS do advise against
using URI characters in namespace searators and expat might be
stricter in future about their use, it's still recomended to address
these isses (I see biboumi in fact did already in #1006333, thanks
Jonas, Slavko and Diane).

Regards,
Salvatore