Release date:
2026-08-21 09:38:53 UTC
Description:
* SECURITY UPDATE: xml.etree.ElementTree Element.findall(), iterfind()
and find() were vulnerable to a quadratic-complexity CPU denial of
service. Evaluating an XPath index predicate ([1], [last()],
[last()-N]) against a document with many same-tag siblings re-ran
parent.findall(elem.tag) once per candidate element, which is
quadratic in the number of siblings.
- debian/patches/CVE-2026-6879.patch: backport of cpython
2ffab083 (gh-152674). Caches the element selected by the index
predicate per (parent, tag) pair, so each sibling group is
scanned only once.
- CVE-2026-6879
Updated packages:
-
alt-python37_3.7.17-30_amd64.deb
sha:d775884a19b525278dfa9cb8343a2e98cc8c1afe
-
alt-python37-debug_3.7.17-30_amd64.deb
sha:9bfdfa0f2a845f1399731e29d1397dff661b4196
-
alt-python37-devel_3.7.17-30_amd64.deb
sha:2f3bb0fe5370a1ff911bcec9b8f5a7eaaac71d8e
-
alt-python37-libs_3.7.17-30_amd64.deb
sha:d39f68466244457b31734468ea5751ed94671c0c
-
alt-python37-test_3.7.17-30_amd64.deb
sha:a7d1d62b17dbf43a365054d38c280f2a397efaa0
-
alt-python37-tkinter_3.7.17-30_amd64.deb
sha:0c3fc1c393e910937753a9385af67a6a07bb072d
-
alt-python37-tools_3.7.17-30_amd64.deb
sha:d82f0f413e31a646285125f2fc4fc96f5be366af
-
alt-python37_3.7.17-30_arm64.deb
sha:33191b24fe04723958b36a6596e2cbafe98d68c0
-
alt-python37-debug_3.7.17-30_arm64.deb
sha:a1b2f9da6ff91c72fa5266b22c8bf2352716140e
-
alt-python37-devel_3.7.17-30_arm64.deb
sha:34358ce61182beb5efceaebb14f9e06b873c077e
-
alt-python37-libs_3.7.17-30_arm64.deb
sha:5e1bd52f40c55b4e8fd0db391caca54e478f7cff
-
alt-python37-test_3.7.17-30_arm64.deb
sha:24e905a87efdd2ee0c5bcea37d5395b8198f5d95
-
alt-python37-tkinter_3.7.17-30_arm64.deb
sha:d97cd58224177776323cd4d6244bf8ff65297ab8
-
alt-python37-tools_3.7.17-30_arm64.deb
sha:b8114a0176919c778bc37f66956011c0ef2c73e3
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
