Debian Patches
Status for lxml/4.9.2-1+deb12u1
| Patch | Description | Author | Forwarded | Bugs | Origin | Last update |
|---|---|---|---|---|---|---|
| do-not-embed-timestamps-in-html.diff | doc/mkhtml.py: Do not embed timestamps in html documentation. | Vagrant Cascadian <vagrant@reproducible-builds.org> | no | 2021-07-11 | ||
| 0002-Make-test-more-reliable-across-different-implementat.patch | Make test more reliable across different implementations. | Stefan Behnel <stefan_ml@behnel.de> | no | https://github.com/lxml/lxml/commit/b7d86ff0c8eba162c179fb634e85493a4e05d1c3 | 2024-04-01 | |
| CVE-2026-28348/01-2ef73266.patch | Implement unicode escape decoding Unicode escapes in CSS were not properly decoded before security checks. This prevents attackers from bypassing filters using escape sequences. |
Lumir Balhar <lbalhar@redhat.com> | yes | upstream | https://github.com/fedora-python/lxml_html_clean/commit/2ef732667ddbc74ea59847bcf24b75809aaeed3b | 2026-02-25 |
| CVE-2026-28348/02-5b7e2288.patch | Restore the removal of all backslashes from styles after decoding of unicode escapes | Lumir Balhar <lbalhar@redhat.com> | yes | upstream | https://github.com/fedora-python/lxml_html_clean/commit/5b7e2288d9e5bda81d1fcf6a4feaed362534899e | 2026-02-26 |
| CVE-2026-28348/03-fd10d79c.patch | Add more tests for different combinations of backslashes and unicode | Lumir Balhar <lbalhar@redhat.com> | yes | upstream | https://github.com/fedora-python/lxml_html_clean/commit/fd10d79cf8a4d4a962e139aee6d02dec02b2de7c | 2026-02-26 |
| CVE-2026-28350.patch | Remove <base> tags to prevent URL hijacking attacks <base> tags are now automatically removed whenever <head> is removed to prevent URL hijacking attacks. According to HTML spec, <base> must be in <head>, but browsers may interpret misplaced <base> tags, allowing attackers to redirect all relative URLs to malicious servers. |
Lumir Balhar <lbalhar@redhat.com> | yes | upstream | https://github.com/fedora-python/lxml_html_clean/commit/9c5612ca33b941eec4178abf8a5294b103403f34 | 2026-02-25 |
| CVE-2026-41066/01-b38cebf2.patch | Disable external entity resolution (XXE) by default This prevents security risks that would allow loading arbitrary external files. |
scoder <stefan_ml@behnel.de> | yes | upstream | https://github.com/lxml/lxml/commit/b38cebf2f846e92bd63de4488fd3d1c8b568f397 | 2023-12-29 |
| CVE-2026-41066/02-ab431ea0.patch | LP#2146291: Set "resolve_entities='internal'" as default for all parser subclasses. | Stefan Behnel <stefan_ml@behnel.de> | yes | upstream | https://github.com/lxml/lxml/commit/ab431ea0b9a7357d968f1d1c5c614649e9aaf358 | 2026-04-10 |
| CVE-2026-49825.patch | Add missing "xlink:href" to the known HTML link attributes. | Stefan Behnel <stefan_ml@behnel.de> | yes | upstream | https://github.com/lxml/lxml/commit/5927a6d5e851845140975d99b65461e255caaab0 | 2026-05-17 |
| Update-.c-files.patch | Update .c files. Generated with find src/lxml -name "*.c" -delete && python3 setup.py build_ext --inplace in a minimal chroot. |
Guilhem Moulin <guilhem@debian.org> | no | 2026-09-28 |
All known versions for source package 'lxml'
- 7.0.0~b1-1 (experimental)
- 6.1.3-1.1 (sid)
- 6.1.3-1 (forky)
- 5.4.0-1 (trixie)
- 4.9.2-1+deb12u1 (bookworm-security)
- 4.9.2-1 (bookworm)