Release date:
2026-08-26 16:11:08 UTC
Description:
* SECURITY UPDATE: xml.etree.ElementTree Element.findall(), iterfind()
and find() were vulnerable to a quadratic-complexity CPU denial of
service. Evaluating an XPath index predicate ([1], [last()],
[last()-N]) against a document with many same-tag siblings re-ran
parent.findall(elem.tag) once per candidate element, which is
quadratic in the number of siblings.
- debian/patches/CVE-2026-6879.patch: backport of cpython
2ffab083 (gh-152674). Caches the element selected by the index
predicate per (parent, tag) pair, so each sibling group is
scanned only once.
- CVE-2026-6879
Updated packages:
-
alt-python37_3.7.17-30_amd64.deb
sha:c9be14da5ed08213cf5e2dbc18a6ce52aacfa6f0
-
alt-python37-debug_3.7.17-30_amd64.deb
sha:ef1ec4f6d0611d6c27cb70750ac7c92b0cc16768
-
alt-python37-devel_3.7.17-30_amd64.deb
sha:8595a21c617c06c87e346fbe5b1d5b0714b218b4
-
alt-python37-libs_3.7.17-30_amd64.deb
sha:89faa5ffec74955ffa89d1aa0b4e1ea9d706a2fc
-
alt-python37-test_3.7.17-30_amd64.deb
sha:df0c4dd1473388092f76a3decd84cb5edfaa9959
-
alt-python37-tkinter_3.7.17-30_amd64.deb
sha:5c2201dfeefa73f672e9e99aa6b0fb0340668359
-
alt-python37-tools_3.7.17-30_amd64.deb
sha:1976f5d9fc33319f41d4504e1a4a03df07ac174f
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
