Skip to content
OpenAdvisories
Medium RLSA-2022:8226 1 CVE

Moderate: python-lxml security update

Published Nov 15, 2022 · Updated Oct 9, 2025

Ecosystem: Rocky Linux

Summary

lxml is an XML processing library providing access to libxml2 and libxslt libraries using the Python ElementTree API.

Security Fix(es):

* lxml: NULL Pointer Dereference in lxml (CVE-2022-2309)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section.

Fixed packages 1

ReleasePackageFixed in
Rocky Linux · 9 python-lxml 0:4.6.5-3.el9

Vulnerabilities 1

  • Medium 5.3
    CVE-2022-2309

    NULL Pointer Dereference in lxml/lxml

    NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through fo…

    lxml lxml/lxml libxml2 libxml2 Debian Ubuntu Azure Linux Alpine PyPI

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2107571