diff options
| author | Miss Skeleton (bot) <31488909+miss-islington@users.noreply.github.com> | 2020-10-20 02:35:23 (GMT) |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2020-10-20 02:35:23 (GMT) |
| commit | 65894cac0835cb8f469f649e20aa1be8bf89f5ae (patch) | |
| tree | 38c0457e2fb026f38468a5fe3024630108907a7b /Misc/NEWS.d | |
| parent | 3faef630a44be2d1ea5516e85e95fef4fd027a95 (diff) | |
| download | cpython-65894cac0835cb8f469f649e20aa1be8bf89f5ae.zip cpython-65894cac0835cb8f469f649e20aa1be8bf89f5ae.tar.gz cpython-65894cac0835cb8f469f649e20aa1be8bf89f5ae.tar.bz2 | |
bpo-42051: Reject XML entity declarations in plist files (GH-22760)
(cherry picked from commit 05ee790f4d1cd8725a90b54268fc1dfe5b4d1fa2)
Co-authored-by: Ronald Oussoren <ronaldoussoren@mac.com>
Diffstat (limited to 'Misc/NEWS.d')
| -rw-r--r-- | Misc/NEWS.d/next/Security/2020-10-19-10-56-27.bpo-42051.EU_B7u.rst | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/Misc/NEWS.d/next/Security/2020-10-19-10-56-27.bpo-42051.EU_B7u.rst b/Misc/NEWS.d/next/Security/2020-10-19-10-56-27.bpo-42051.EU_B7u.rst new file mode 100644 index 0000000..e865ed1 --- /dev/null +++ b/Misc/NEWS.d/next/Security/2020-10-19-10-56-27.bpo-42051.EU_B7u.rst @@ -0,0 +1,3 @@ +The :mod:`plistlib` module no longer accepts entity declarations in XML +plist files to avoid XML vulnerabilities. This should not affect users as +entity declarations are not used in regular plist files. |