From 6abdb2b394007c84a2ef9d0560a5f1fe90465a53 Mon Sep 17 00:00:00 2001 From: Azure Linux Security Servicing Account Date: Fri, 21 Aug 2026 02:14:23 +0000 Subject: [PATCH] Patch python-lxml for CVE-2026-49825 --- SPECS/python-lxml/CVE-2026-49825.patch | 40 +++++++++++++++++++ SPECS/python-lxml/python-lxml.spec | 6 ++- .../manifests/package/toolchain_aarch64.txt | 2 +- .../manifests/package/toolchain_x86_64.txt | 2 +- 4 files changed, 47 insertions(+), 3 deletions(-) create mode 100644 SPECS/python-lxml/CVE-2026-49825.patch diff --git a/SPECS/python-lxml/CVE-2026-49825.patch b/SPECS/python-lxml/CVE-2026-49825.patch new file mode 100644 index 00000000000..9da182017e7 --- /dev/null +++ b/SPECS/python-lxml/CVE-2026-49825.patch @@ -0,0 +1,40 @@ +From 1a061a9645e346075ef690dc9501dabf601fe114 Mon Sep 17 00:00:00 2001 +From: Stefan Behnel +Date: Sun, 17 May 2026 21:42:51 +0200 +Subject: [PATCH] Add missing "xlink:href" to the known HTML link attributes. + Closes + https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f + +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://github.com/lxml/lxml/commit/5927a6d5e851845140975d99b65461e255caaab0.patch +--- + src/lxml/html/defs.py | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/src/lxml/html/defs.py b/src/lxml/html/defs.py +index 2058ea3..da7edf8 100644 +--- a/src/lxml/html/defs.py ++++ b/src/lxml/html/defs.py +@@ -24,7 +24,9 @@ link_attrs = frozenset([ + # Not standard: + 'dynsrc', 'lowsrc', + # HTML5 formaction +- 'formaction' ++ 'formaction', ++ # XLink as used by HTML5 (including embedded SVG/MathML) ++ 'xlink:href', + ]) + + # Not in the HTML 4 spec: +@@ -117,7 +119,7 @@ font_style_tags = frozenset([ + frame_tags = frozenset([ + 'frameset', 'frame', 'noframes', + ]) +- ++ + html5_tags = frozenset([ + 'article', 'aside', 'audio', 'canvas', 'command', 'datalist', + 'details', 'embed', 'figcaption', 'figure', 'footer', 'header', +-- +2.45.4 + diff --git a/SPECS/python-lxml/python-lxml.spec b/SPECS/python-lxml/python-lxml.spec index c27760a5a6e..1ca0bd47ab6 100644 --- a/SPECS/python-lxml/python-lxml.spec +++ b/SPECS/python-lxml/python-lxml.spec @@ -3,7 +3,7 @@ Summary: XML and HTML with Python Name: python-lxml Version: 4.9.3 -Release: 2%{?dist} +Release: 3%{?dist} # Test suite (and only the test suite) is GPLv2+ License: BSD and GPLv2+ Vendor: Microsoft Corporation @@ -12,6 +12,7 @@ URL: https://lxml.de Source0: https://github.com/lxml/lxml/releases/download/lxml-%{version}/lxml-%{version}.tar.gz Patch0: noexcept.patch Patch1: CVE-2026-41066.patch +Patch2: CVE-2026-49825.patch BuildRequires: libxslt-devel BuildRequires: libxml2-devel BuildRequires: python3-Cython @@ -53,6 +54,9 @@ make test %{python3_sitelib}/* %changelog +* Fri Aug 21 2026 Azure Linux Security Servicing Account - 4.9.3-3 +- Patch for CVE-2026-49825 + * Wed Apr 29 2026 Azure Linux Security Servicing Account - 4.9.3-2 - Patch for CVE-2026-41066 diff --git a/toolkit/resources/manifests/package/toolchain_aarch64.txt b/toolkit/resources/manifests/package/toolchain_aarch64.txt index 916884293a6..3e26afb2b84 100644 --- a/toolkit/resources/manifests/package/toolchain_aarch64.txt +++ b/toolkit/resources/manifests/package/toolchain_aarch64.txt @@ -545,7 +545,7 @@ python3-libcap-ng-0.8.4-1.azl3.aarch64.rpm python3-libmount-2.40.2-5.azl3.aarch64.rpm python3-libs-3.12.14-1.azl3.aarch64.rpm python3-libxml2-2.11.5-10.azl3.aarch64.rpm -python3-lxml-4.9.3-2.azl3.aarch64.rpm +python3-lxml-4.9.3-3.azl3.aarch64.rpm python3-magic-5.45-1.azl3.noarch.rpm python3-markupsafe-2.1.3-1.azl3.aarch64.rpm python3-newt-0.52.23-1.azl3.aarch64.rpm diff --git a/toolkit/resources/manifests/package/toolchain_x86_64.txt b/toolkit/resources/manifests/package/toolchain_x86_64.txt index eeb8e5570a7..bf35a652bbe 100644 --- a/toolkit/resources/manifests/package/toolchain_x86_64.txt +++ b/toolkit/resources/manifests/package/toolchain_x86_64.txt @@ -553,7 +553,7 @@ python3-libcap-ng-0.8.4-1.azl3.x86_64.rpm python3-libmount-2.40.2-5.azl3.x86_64.rpm python3-libs-3.12.14-1.azl3.x86_64.rpm python3-libxml2-2.11.5-10.azl3.x86_64.rpm -python3-lxml-4.9.3-2.azl3.x86_64.rpm +python3-lxml-4.9.3-3.azl3.x86_64.rpm python3-magic-5.45-1.azl3.noarch.rpm python3-markupsafe-2.1.3-1.azl3.x86_64.rpm python3-newt-0.52.23-1.azl3.x86_64.rpm