Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Python 3 packages add stronger hash protection
published 4 months ago
Summary
Red Hat's Python 3 packages (including the standard library and development tools) now use a longer random value when hashing XML data, which helps stop hash‑flooding attacks that could slow or crash a system. This improves the reliability of XML parsing. Apply the latest updates for these Python 3 packages to benefit from the fix.
What to do
- Update redhat python3 to version 3.6.8-21.0.5.el7_9.tuxcare.els11.
- Update redhat python3-debug to version 3.6.8-21.0.5.el7_9.tuxcare.els11.
- Update redhat python3-devel to version 3.6.8-21.0.5.el7_9.tuxcare.els11.
- Update redhat python3-idle to version 3.6.8-21.0.5.el7_9.tuxcare.els11.
- Update redhat python3-libs to version 3.6.8-21.0.5.el7_9.tuxcare.els11.
- Update redhat python3-test to version 3.6.8-21.0.5.el7_9.tuxcare.els11.
- Update redhat python3-tkinter to version 3.6.8-21.0.5.el7_9.tuxcare.els11.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:RHEL:7 | redhat | python3 |
< 3.6.8-21.0.5.el7_9.tuxcare.els11 Fix: upgrade to 3.6.8-21.0.5.el7_9.tuxcare.els11
|
| TuxCare:RHEL:7 | redhat | python3-debug |
< 3.6.8-21.0.5.el7_9.tuxcare.els11 Fix: upgrade to 3.6.8-21.0.5.el7_9.tuxcare.els11
|
| TuxCare:RHEL:7 | redhat | python3-devel |
< 3.6.8-21.0.5.el7_9.tuxcare.els11 Fix: upgrade to 3.6.8-21.0.5.el7_9.tuxcare.els11
|
| TuxCare:RHEL:7 | redhat | python3-idle |
< 3.6.8-21.0.5.el7_9.tuxcare.els11 Fix: upgrade to 3.6.8-21.0.5.el7_9.tuxcare.els11
|
| TuxCare:RHEL:7 | redhat | python3-libs |
< 3.6.8-21.0.5.el7_9.tuxcare.els11 Fix: upgrade to 3.6.8-21.0.5.el7_9.tuxcare.els11
|
| TuxCare:RHEL:7 | redhat | python3-test |
< 3.6.8-21.0.5.el7_9.tuxcare.els11 Fix: upgrade to 3.6.8-21.0.5.el7_9.tuxcare.els11
|
| TuxCare:RHEL:7 | redhat | python3-tkinter |
< 3.6.8-21.0.5.el7_9.tuxcare.els11 Fix: upgrade to 3.6.8-21.0.5.el7_9.tuxcare.els11
|
Original advisory text
python3: Fix of CVE-2026-7210
- CVE-2026-7210: use 16-byte salt for Expat hash-flooding protection (xml.parsers.expat, xml.etree.ElementTree)
References
- https://errata.tuxcare.com/els_os/rhel7els/CLSA-2026-1780700238.html Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-7210 Vendor Advisory
Timeline
Published8 Jun 2026
Updated26 Oct 2026
First seen26 Oct 2026
Sources
CLSA-2026-1780700238 · OSV
Track software like this
Free during beta