[New-bugs-announce] [issue34623] _elementtree.c doesn't call XML_SetHashSalt()

[Christian Heimes]

New submission from Christian Heimes <lists at cheimes.de>:

The pyexpat module calls XML_SetHashSalt(self->itself,                   (unsigned long)_Py_HashSecret.expat.hashsalt) to initialize the salt for hash randomization of the XML_Parser struct. The _elementree C accelerator doesn't call XML_SetHashSalt().

It's not a security issue with recent versions of libexpat. The library initializes the salt from a good entry source by default.

----------
components: XML
messages: 324954
nosy: christian.heimes
priority: normal
severity: normal
status: open
title: _elementtree.c doesn't call XML_SetHashSalt()
type: behavior
versions: Python 3.8

_______________________________________
Python tracker <report at bugs.python.org>
<https://bugs.python.org/issue34623>
_______________________________________