Document new CVE-2023-52425 Expat API (reparse deferral)

hartwork · hartwork · commit 439d97037c81 · 2024-02-18T21:15:54.000+01:00
diff --git a/Misc/NEWS.d/next/Security/2024-02-18-03-14-40.gh-issue-115398.tzvxH8.rst b/Misc/NEWS.d/next/Security/2024-02-18-03-14-40.gh-issue-115398.tzvxH8.rst
@@ -0,0 +1,8 @@
+Allow controlling Expat >=2.6.0 reparse deferral (CVE-2023-52425) by adding
+five new methods:
+
+* ``pyexpat.xmlparser.GetReparseDeferralEnabled``
+* ``pyexpat.xmlparser.SetReparseDeferralEnabled``
+* ``xml.etree.ElementTree.XMLParser.flush``
+* ``xml.etree.ElementTree.XMLPullParser.flush``
+* ``xml.sax.expatreader.ExpatParser.flush``
