#!/usr/bin/env python3 # Security vulnerability fixes in Python 3.12.12+ import sys import ssl import xml.parsers.expat from html.parser import HTMLParser import tarfile import zipfile print(f"Python version: {sys.version}") # CVE-2025-59375: libexpat upgraded to 2.7.3 # XML parsing is now safer with updated expat library parser = xml.parsers.expat.ParserCreate() parser.buffer_text = True xml_data = 'data' try: parser.Parse(xml_data) print("✓ XML parsing with upgraded libexpat 2.7.3") except Exception as e: print(f"✗ XML parsing failed: {e}") # gh-139400: ExternalEntityParserCreate garbage collection fix master_parser = xml.parsers.expat.ParserCreate() child_parser = master_parser.ExternalEntityParserCreate('') print("✓ External entity parser creation with proper garbage collection") # gh-130577: tarfile validates member offsets are non-negative try: with tarfile.open('.tar', 'r') as tar: for member in tar.getmembers(): if member.offset >= 0: print(f"✓ Valid tar member offset: {member.name}") except tarfile.TarError as e: print(f"✗ Invalid tar archive: {e}") # gh-139700: zip64 consistency checking try: with zipfile.ZipFile('.zip', 'r') as zf: print(f"✓ Zip64 archive validated: {len(zf.namelist())} entries") except zipfile.BadZipFile as e: print(f"✗ Invalid zip archive: {e}") # gh-135661: HTML5-compliant parsing class SecureHTMLParser(HTMLParser): def __init__(self): super().__init__() self.tags = [] def handle_starttag(self, tag, attrs): self.tags.append(tag) print(f"✓ HTML5-compliant start tag: <{tag}>") def handle_endtag(self, tag): print(f"✓ HTML5-compliant end tag: ") html_parser = SecureHTMLParser() html_content = '

Test

' html_parser.feed(html_content) # CVE-2024-5642: SSL NPN protocols validation (Python 3.9.24+) try: context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT) # Empty protocols list now raises SSLError context.set_npn_protocols([]) print("⚠ Empty NPN protocols accepted") except ssl.SSLError as e: print(f"✓ Empty NPN protocols rejected: {e}") print(f"\n✓ Security patches applied successfully in Python {sys.version.split()[0]}")

Python 3.12.12, 3.11.14, 3.10.19 and 3.9.24 are now available!

More from Python 3.12