Release date:
2026-08-26 16:29:03 UTC
Description:
* SECURITY UPDATE: xml.etree.ElementTree Element.findall(), iterfind()
and find() were vulnerable to a quadratic-complexity CPU denial of
service. Evaluating an XPath index predicate ([1], [last()],
[last()-N]) against a document with many same-tag siblings re-ran
parent.findall(elem.tag) once per candidate element, which is
quadratic in the number of siblings.
- debian/patches/CVE-2026-6879.patch: backport of cpython
2ffab083 (gh-152674). Caches the element selected by the index
predicate per (parent, tag) pair, so each sibling group is
scanned only once.
- CVE-2026-6879
Updated packages:
-
alt-python37_3.7.17-30_amd64.deb
sha:5d734286c6961764f7c5b798f6dbfd2dd202008e
-
alt-python37-debug_3.7.17-30_amd64.deb
sha:9644742ef9d0dcd9382d18f361257585f832cfc3
-
alt-python37-devel_3.7.17-30_amd64.deb
sha:49b5eb3799741f808d2845537afaf29286de9785
-
alt-python37-libs_3.7.17-30_amd64.deb
sha:de9bd9c0d49027268a99f78a542111bdb483c99d
-
alt-python37-test_3.7.17-30_amd64.deb
sha:62535840050d04cc3946d07ecfb217b19bee2909
-
alt-python37-tkinter_3.7.17-30_amd64.deb
sha:8ed75063db6c1280de76e7223e4ba596df37a5fc
-
alt-python37-tools_3.7.17-30_amd64.deb
sha:16be4f0f6ce508f315ccaae1edea46de5a03e1d1
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
