Описание
Security update for python3-lxml
This update for python3-lxml fixes the following issue
- CVE-2026-41066: Information disclosure via untrusted XML input leading to local file read (bsc#1263254).
Список пакетов
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5
python3-lxml-3.6.1-3.9.1
Ссылки
- Link for SUSE-SU-2026:2752-1
- E-Mail link for SUSE-SU-2026:2752-1
- SUSE Security Ratings
- SUSE Bug 1263254
- SUSE CVE CVE-2026-41066 page
Описание
lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (with resolve_entities=True) allows untrusted XML input to read local files. Setting the resolve_entities option explicitly to resolve_entities='internal' or resolve_entities=False disables the local file access. This vulnerability is fixed in 6.1.0.
Затронутые продукты
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:python3-lxml-3.6.1-3.9.1
Ссылки
- CVE-2026-41066
- SUSE Bug 1263254