Release date:
2026-08-21 09:27:08 UTC
Description:
* SECURITY UPDATE: xml.etree.ElementTree Element.findall(), iterfind()
and find() were vulnerable to a quadratic-complexity CPU denial of
service. Evaluating an XPath index predicate ([1], [last()],
[last()-N]) against a document with many same-tag siblings re-ran
parent.findall(elem.tag) once per candidate element, which is
quadratic in the number of siblings.
- debian/patches/CVE-2026-6879.patch: backport of cpython
2ffab083 (gh-152674). Caches the element selected by the index
predicate per (parent, tag) pair, so each sibling group is
scanned only once.
- CVE-2026-6879
Updated packages:
-
alt-python37_3.7.17-30_amd64.deb
sha:a7eb50b8e336a3ff65ca4933e159399a5ea30e1e
-
alt-python37-debug_3.7.17-30_amd64.deb
sha:0ba9b18f2334cf27d12fdc712481fa7909b6ae11
-
alt-python37-devel_3.7.17-30_amd64.deb
sha:4d7c9d3dab2fad0192fb701742cd1a8a002a57fc
-
alt-python37-libs_3.7.17-30_amd64.deb
sha:e5d6f2e0730dd9122f0b7af756e8f404d509dd4a
-
alt-python37-test_3.7.17-30_amd64.deb
sha:c9b0ec5dbfef02a8f85b79c64cda5beb5c7d0b9f
-
alt-python37-tkinter_3.7.17-30_amd64.deb
sha:1cf65719caad3f8b0825494ab4d28595698b4bdb
-
alt-python37-tools_3.7.17-30_amd64.deb
sha:d82f0f413e31a646285125f2fc4fc96f5be366af
-
alt-python37_3.7.17-30_arm64.deb
sha:81ae1059b46322cecbeba0178417d00f47a0425e
-
alt-python37-debug_3.7.17-30_arm64.deb
sha:b2cfd4ff4df80963d2b8586cb0ce854107762ede
-
alt-python37-devel_3.7.17-30_arm64.deb
sha:7bf50242e89320b29c95d8aac7f18280867f873c
-
alt-python37-libs_3.7.17-30_arm64.deb
sha:ff37a8ab7dbde655166d6357f99ccd9d2460de17
-
alt-python37-test_3.7.17-30_arm64.deb
sha:b7aa75e9a907eb1f70c9829a1c1c51ebb2031447
-
alt-python37-tkinter_3.7.17-30_arm64.deb
sha:49e53532f8c2f2826ef2f6e0b5fd084b5a8a5ac9
-
alt-python37-tools_3.7.17-30_arm64.deb
sha:b8114a0176919c778bc37f66956011c0ef2c73e3
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
