5.0.2+security.1 — CVE-2026-41066 security backport#2
Open
martinPavesio wants to merge 3 commits into
Open
Conversation
…ility - setupinfo.py: route to AS-installed libxml2/libxslt via pkg-config - setupinfo.py: replace f-string in get_dotfile_version() with str.format() so setup.py can be invoked under Python 2.7 - setupinfo.py: use 'z' instead of 'zlib' in Windows libs.extend() for correct static zlib library name - versioninfo.py: use __file__ instead of sys.argv[0] for base directory detection so it works correctly when invoked via the AS wheel builder
…on sources CVE-2026-41066 (GHSA-vfmq-68hx-4jfw): iterparse() and ETCompatXMLParser() defaulted to resolve_entities=True, allowing XXE injection from untrusted XML. Upstream fix: lxml 6.1.0, commit ab431ea (LP#2146291). - iterparse.pxi: resolve_entities default True -> 'internal' - parser.pxi: ETCompatXMLParser resolve_entities default True -> 'internal' - proxy.pxi: cast &c_attribute.defaultValue to <const_xmlChar**> at the _fixThreadDictPtr call site to fix -Werror=incompatible-pointer-types on GCC 14 / libxml2 2.15.x (Rocky 9 builder) Cython 3 will regenerate etree.c from these sources at build time.
Version string: 5.0.2+security.1 (PEP 440 local identifier) Git tag: 5.0.2.1 CHANGES.txt updated with security release notes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of CVE-2026-41066 (GHSA-vfmq-68hx-4jfw) for Python 2.7.
Commits
Tag
5.0.2.1(version string:5.0.2+security.1)Ticket: CS-2178