Index: python-boto/tests/unit/utils/test_utils.py
===================================================================
--- python-boto.orig/tests/unit/utils/test_utils.py
+++ python-boto/tests/unit/utils/test_utils.py
@@ -85,7 +85,7 @@ class TestPassword(unittest.TestCase):
         def hmac_hashfunc(cls, msg):
             if not isinstance(msg, bytes):
                 msg = msg.encode('utf-8')
-            return hmac.new(b'mysecretkey', msg)
+            return hmac.new(b'mysecretkey', msg, digestmod='sha256')

         class HMACPassword(Password):
             hashfunc = hmac_hashfunc
@@ -95,15 +95,15 @@ class TestPassword(unittest.TestCase):
         password.set('foo')

         self.assertEquals(str(password),
-                          hmac.new(b'mysecretkey', b'foo').hexdigest())
+                          hmac.new(b'mysecretkey', b'foo', digestmod='sha256').hexdigest())

     def test_constructor(self):
-        hmac_hashfunc = lambda msg: hmac.new(b'mysecretkey', msg)
+        hmac_hashfunc = lambda msg: hmac.new(b'mysecretkey', msg, digestmod='sha256')

         password = Password(hashfunc=hmac_hashfunc)
         password.set('foo')
         self.assertEquals(password.str,
-                          hmac.new(b'mysecretkey', b'foo').hexdigest())
+                          hmac.new(b'mysecretkey', b'foo', digestmod='sha256').hexdigest())


 class TestPythonizeName(unittest.TestCase):
Index: python-boto/boto/ecs/item.py
===================================================================
--- python-boto.orig/boto/ecs/item.py
+++ python-boto/boto/ecs/item.py
@@ -22,6 +22,7 @@

 import xml.sax
 import cgi
+from html import escape
 from boto.compat import six, StringIO

 class ResponseGroup(xml.sax.ContentHandler):
@@ -67,7 +68,7 @@ class ResponseGroup(xml.sax.ContentHandl
         return None

     def endElement(self, name, value, connection):
-        self._xml.write("%s</%s>" % (cgi.escape(value).replace("&amp;amp;", "&amp;"), name))
+        self._xml.write("%s</%s>" % (escape(value).replace("&amp;amp;", "&amp;"), name))
         if len(self._nodepath) == 0:
             return
         obj = None