Skip to content
OpenAdvisories
Medium ALSA-2022:8226 1 CVE

Moderate: python-lxml security update

Published Nov 15, 2022 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

lxml is an XML processing library providing access to libxml2 and libxslt libraries using the Python ElementTree API.

Security Fix(es):

* lxml: NULL Pointer Dereference in lxml (CVE-2022-2309)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Fixed packages 1

ReleasePackageFixed in
AlmaLinux · 9 python3-lxml 4.6.5-3.el9

Vulnerabilities 1

  • Medium 5.3
    CVE-2022-2309

    NULL Pointer Dereference in lxml/lxml

    NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through fo…

    lxml lxml/lxml libxml2 libxml2 Debian Ubuntu Azure Linux Alpine PyPI

References

  • report
    https://access.redhat.com/security/cve/CVE-2022-2309
  • report
    https://bugzilla.redhat.com/2107571
  • advisory
    https://errata.almalinux.org/9/ALSA-2022-8226.html