CLSA-2026-1781252690

See a problem?
Import Source
https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/rhel7els/CLSA-2026-1781252690.json
JSON Data
https://api.osv.dev/v1/vulns/CLSA-2026-1781252690
Upstream
CVE (2)
Published
2026-06-25T08:35:47Z
Modified
2026-10-26T09:43:55Z
Summary
python: Fix of 5 CVEs
Details
  • CVE-2026-7210: seed Expat's hash-flooding protection with a full 16 bytes (128 bits) of entropy via XML_SetHashSalt16Bytes() when the loaded libexpat provides it (detected via a weak symbol), instead of the brute-forceable 8-byte XML_SetHashSalt(); the pyexpat CAPI gains a SetHashSalt16Bytes pointer appended at the end of the struct (capsule magic unchanged) and _Py_HashSecret_t gains a 16-byte hashsalt16 field. Both call sites fall back to the legacy 8-byte API when the salt is all zeros (hash randomization off, the default) so Expat keeps self-seeding. Paired with the libexpat CVE-2026-41080 backport that exports the symbol; requires expat >= 2.1.0-15.0.7.el7_9.tuxcare.els3, the release shipping it
References

Affected packages

TuxCare:RHEL:7
python

Package

Name
python
Purl
pkg:rpm/tuxcare/python?distro=rhel-7

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.7.5-94.0.1.el7_9.tuxcare.els9

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/rhel7els/CLSA-2026-1781252690.json"
python-debug

Package

Name
python-debug
Purl
pkg:rpm/tuxcare/python-debug?distro=rhel-7

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.7.5-94.0.1.el7_9.tuxcare.els9

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/rhel7els/CLSA-2026-1781252690.json"
python-devel

Package

Name
python-devel
Purl
pkg:rpm/tuxcare/python-devel?distro=rhel-7

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.7.5-94.0.1.el7_9.tuxcare.els9

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/rhel7els/CLSA-2026-1781252690.json"
python-libs

Package

Name
python-libs
Purl
pkg:rpm/tuxcare/python-libs?distro=rhel-7

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.7.5-94.0.1.el7_9.tuxcare.els9

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/rhel7els/CLSA-2026-1781252690.json"
python-test

Package

Name
python-test
Purl
pkg:rpm/tuxcare/python-test?distro=rhel-7

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.7.5-94.0.1.el7_9.tuxcare.els9

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/rhel7els/CLSA-2026-1781252690.json"
python-tools

Package

Name
python-tools
Purl
pkg:rpm/tuxcare/python-tools?distro=rhel-7

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.7.5-94.0.1.el7_9.tuxcare.els9

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/rhel7els/CLSA-2026-1781252690.json"
tkinter

Package

Name
tkinter
Purl
pkg:rpm/tuxcare/tkinter?distro=rhel-7

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.7.5-94.0.1.el7_9.tuxcare.els9

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/rhel7els/CLSA-2026-1781252690.json"