Summary
[4.2.3-5]
- Security fix for CVE-2026-49825: missing xlink:href in known HTML
link attributes
Resolves: RHEL-251508
[4.2.3-4]
- Security fix for CVE-2021-43818
Resolves: rhbz#2032569
[4.2.3-3]
- Security fix for CVE-2021-28957
Resolves: rhbz#1941534
[4.2.3-2]
- Security fix for CVE-2020-27783: mXSS due to the use of improper parser
Resolves: rhbz#1901633
[4.2.3-1]
- New upstream release 4.2.3
[4.1.1-3]
- Conditionalize the python2 subpackage
[4.1.1-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
[4.1.1-1]
- Update to 4.1.1
[4.0.0-2]
- Conditionally allow building without Cython
[4.0.0-1]
- Update to 4.0.0
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | python3-lxml | 0:4.2.3-5.el8_10 |
Vulnerabilities 1
-
High 8.2
lxml: javascript: URL bypass in Cleaner via xlink:href
lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in ``lxml.html.defs.link_attrs`` were missing ``xlink:href``, which can be used for URL bypass attacks in embedded SVG/MathML/etc. content. This vulnerabilit…