CVE-2024-41946: DoS vulnerability in REXML

There is a DoS vulnerability in REXML gem. This vulnerability has been assigned the CVE identifier CVE-2024-41946. We strongly recommend upgrading the REXML gem.

Details

When parsing an XML that has many entity expansions with SAX2 or pull parser API, REXML gem may take long time.

Please update REXML gem to version 3.3.3 or later.

Affected versions

  • REXML gem 3.3.2 or prior

Credits

Thanks to NAITOH Jun for discovering and fixing this issue.

History

  • Originally published at 2024-08-01 03:00:00 (UTC)

Posted by kou on 1 Aug 2024

Python 3.13.0 release candidate 1 released

 I’m pleased to announce the release of Python 3.13 release candidate 1.

https://www.python.org/downloads/release/python-3130rc1/

 

This is the first release candidate of Python 3.13.0

This release, 3.13.0rc1, is the penultimate release
preview. Entering the release candidate phase, only reviewed code
changes which are clear bug fixes are allowed between this release
candidate and the final release. The second candidate (and the last
planned release preview) is scheduled for Tuesday, 2024-09-03, while the
official release of 3.13.0 is scheduled for Tuesday, 2024-10-01.

There will be no ABI changes from this point forward in the 3.13 series, and the goal is that there will be as few code changes as possible.

Call to action

We strongly encourage maintainers of third-party Python projects to
prepare their projects for 3.13 compatibilities during this phase, and
where necessary publish Python 3.13 wheels on PyPI to be ready for the
final release of 3.13.0. Any binary wheels built against Python
3.13.0rc1 will work with future versions of Python 3.13. As always, report any issues to the Python bug tracker.

Please keep in mind that this is a preview release and while it’s as close to the final release as we can get it, its use is not recommended for production environments.

Core developers: time to work on documentation now

  • Are all your changes properly documented?
  • Are they mentioned in What’s New?
  • Did you notice other changes you know of to have insufficient documentation?

 

Major new features of the 3.13 series, compared to 3.12

Some of the new major new features and changes in Python 3.13 are:

New features

Typing

Removals and new deprecations

  • PEP 594 (Removing dead batteries from the standard library) scheduled removals of many deprecated modules: aifc, audioop, chunk, cgi, cgitb, crypt, imghdr, mailcap, msilib, nis, nntplib, ossaudiodev, pipes, sndhdr, spwd, sunau, telnetlib, uu, xdrlib, lib2to3.
  • Many other removals of deprecated classes, functions and methods in various standard library modules.
  • C API removals and deprecations. (Some removals present in alpha 1 were reverted in alpha 2, as the removals were deemed too disruptive at this time.)
  • New deprecations, most of which are scheduled for removal from Python 3.15 or 3.16.

(Hey, fellow core developer, if a feature you find important is missing from this list, let Thomas know.)

For more details on the changes to Python 3.13, see What’s new in Python 3.13. The next pre-release of Python 3.13 will be 3.13.0rc2, the final release candidate, currently scheduled for 2024-09-03.

 

More resources

 

Enjoy the new releases

Thanks to all of the many volunteers who help make Python Development
and these releases possible! Please consider supporting our efforts by
volunteering yourself or through organization contributions to the
Python Software Foundation.

Whatevs,

Your release team,
Thomas Wouters
Łukasz Langa
Ned Deily
Steve Dower

AI causing burnout, lower productivity

Is machine learning, also known as “artificial intelligence”, really aiding workers and increasing productivity? A study by Upwork – which, as Baldur Bjarnason so helpfully points out, sells AI solutions and hence did not promote this study on its blog as it does with its other studies – reveals that this might not actually be the case. Nearly half (47%) of workers using AI say they have no idea how to achieve the productivity gains their employers expect. Over three in four (77%) say AI tools have decreased their productivity and added to their workload in at least one way. For example, survey respondents reported that they’re spending more time reviewing or moderating AI-generated content (39%), invest more time learning to use these tools (23%), and are now being asked to do more work (21%). Forty percent of employees feel their company is asking too much of them when it comes to AI. ↫ Upwork research This shouldn’t come as a surprise. We’re in a massive hype cycle when it comes to machine learning, and we’re being told it’s going to revolutionise work and lead to massive productivity gains. In practice, however, it seems these tools just can’t measure up to the hyped promises, and in fact is making people do less and work slower. There’s countless stories of managers being told by upper management to shove machine learning into everything, from products to employee workflows, whether it makes any sense to do so or not. I know from experience as a translator that machine learning can greatly improve my productivity, but the fact that there are certain types of tasks that benefit from ML, doesn’t mean every job suddenly thrives with it. I’m definitely starting to see some cracks in the hype cycle, and this study highlights a major one. I hope we can all come down to earth again, and really take a careful look at where ML makes sense and where it does not, instead of giving every worker a ChatGPT account and blanket demanding massive productivity gains that in no way match the reality on the office floor. And of course, despite demanding massive productivity increases, it’s not like workers are getting an equivalent increase in salary. We’ve seen massive productivity increases for decades now, while paychecks have not followed suit at all, and many people can actually buy less with their salary today than their parents could decades ago. Demands imposed by managers by introducing AI is only going to make this discrepancy even worse.

[Extraordinary Attorney Woo] Are you even best friends if you don’t have a special way to say…

#jo2024 #NetflixReview #Movies

All Links: ☠️ More Movie
YouTube :::
https://www.youtube.com/@Bailumylulu
BiliBili :::
https://www.bilibili.tv/en/space/2055644159
Dailymotion :::
https://www.dailymotion.com/MusicLulu

ABOUT NETFLIX REVIEW
Netflix K-Content is the channel that takes you deeper into all types of Netflix Korean Content you LOVE. Whether you’re in the mood for some fun with the stars, want to relive your favorite moments, need help deciding what to watch next based on your personal taste, or commiserate with like-minded fans, you’re in the right place.

All things NETFLIX REVIEW.

Email:::
alexmapliejack@gmile.com

ChatGPT Course Section 6 Generating Tables

ChatGPT is a text-based generative AI tool that can do various tasks. In this course, you will learn how to write prompts, generate content, generate codes and utilise its powerful features.

In this video lesson, we will learn about Generating Tables in ChatGPT.

You can access the entire ChatGPT Course in the following playlist:
https://dailymotion.com/rss/playlist/x8jx4a

నిండు కుండలా Srisailam Project.. గత ఏడేళ్లలో 2వ సారి 10 గేట్లు ఎత్తివేత | Oneindia Telugu

Srisailam project has reached full capacity. In this background, the officials of the project raised ten gates of water to Nagarjuna Sagar.
శ్రీశైలం ప్రాజెక్టు పూర్తిస్థాయి సామర్థ్యానికి చేరుకుంది. ఈ నేపథ్యంలో ప్రాజెక్టు పదిగేట్లు ఎత్తి నీటిని నాగార్జున సాగర్ కు అధికారులు వదులుతున్నారు.
#Krishnariver
#Srisailamdam
#Srisailam
#nagarjunasagar

~PR.350~CA.240~ED.232~HT.286~