HTML-escape the plain traceback in cgitb's HTML output, to prevent
the traceback inadvertently or maliciously closing the comment and
injecting HTML into the error page.
(backport from rev. 55348)
diff --git a/Misc/NEWS b/Misc/NEWS
index 65e176e..8e8254d 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -12,6 +12,10 @@
Library
-------
+- HTML-escape the plain traceback in cgitb's HTML output, to prevent
+ the traceback inadvertently or maliciously closing the comment and
+ injecting HTML into the error page.
+
- Bug #1290505: Properly clear time.strptime's locale cache when the locale
changes between calls. Backport of r54646 and r54647.