Re: [BLFS Trac] #23162: lxml-6.1.0 (Python module)

#23162: lxml-6.1.0 (Python module)
-------------------------+-------------------------------
 Reporter:  Bruce Dubbs  |       Owner:  SecurityAdvisory
     Type:  enhancement  |      Status:  new
 Priority:  elevated     |   Milestone:  13.1
Component:  BOOK         |     Version:  git
 Severity:  normal       |  Resolution:
 Keywords:               |
-------------------------+-------------------------------
Changes (by Joe Locash):

 * owner:  Joe Locash => SecurityAdvisory
 * priority:  normal => elevated
 * status:  assigned => new

Comment:

 {{{
 6.1.0 (2026-04-17)
 ==================

 This release fixes a possible external entity injection (XXE)
 vulnerability in
 ``iterparse()`` and the ``ETCompatXMLParser``.

 Features added
 --------------

 * GH#486: The HTML ARIA accessibility attributes were added to the set of
 safe attributes
   in ``lxml.html.defs``.  This allows ``lxml_html_clean`` to pass them
 through.
   Patch by oomsveta.

 * The default chunk size for reading from file-likes in ``iterparse()`` is
 now configurable
   with a new ``chunk_size`` argument.

 Bugs fixed
 ----------

 * LP#2146291: The ``resolve_entities`` option was still set to ``True``
 for
   ``iterparse`` and ``ETCompatXMLParser``, allowing for external entity
 injection (XXE)
   when using these parsers without setting this option explicitly.
   The default was now changed to ``'internal'`` only (as for the normal
 XML and HTML parsers
   since lxml 5.0).
   Issue found by Sihao Qiu as CVE-2026-41066.
 }}}
 Fixed at 10b247d05e. Leaving open for SA.
-- 
Ticket URL: <https://wiki.linuxfromscratch.org/blfs/ticket/23162#comment:2>
BLFS Trac <https://wiki.linuxfromscratch.org/blfs/>
Beyond Linux From Scratch

-- 
http://lists.linuxfromscratch.org/sympa/info/blfs-book
Unsubscribe: See the above information page