Описание
Security update for python-lxml
This update for python-lxml fixes the following issue
- CVE-2026-41066: Information disclosure via untrusted XML input leading to local file read (bsc#1263254).
Список пакетов
openSUSE Leap 16.0
python-lxml-doc-5.4.0-160000.3.1
python313-lxml-5.4.0-160000.3.1
python313-lxml-devel-5.4.0-160000.3.1
Ссылки
- SUSE Security Ratings
- SUSE Bug 1263254
- SUSE CVE CVE-2026-41066 page
Описание
lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (with resolve_entities=True) allows untrusted XML input to read local files. Setting the resolve_entities option explicitly to resolve_entities='internal' or resolve_entities=False disables the local file access. This vulnerability is fixed in 6.1.0.
Затронутые продукты
openSUSE Leap 16.0:python-lxml-doc-5.4.0-160000.3.1
openSUSE Leap 16.0:python313-lxml-5.4.0-160000.3.1
openSUSE Leap 16.0:python313-lxml-devel-5.4.0-160000.3.1
Ссылки
- CVE-2026-41066
- SUSE Bug 1263254