[Buildroot] [git commit] package/python-lxml: security bump to version 4.6.5
Arnout Vandecappelle (Essensium/Mind)
arnout at mind.be
Mon Dec 20 22:18:48 UTC 2021
commit: https://git.buildroot.net/buildroot/commit/?id=ad6321660c91c9440c17a770505bfc1742e57d33
branch: https://git.buildroot.net/buildroot/commit/?id=refs/heads/master
- A vulnerability (GHSL-2021-1038) in the HTML cleaner allowed sneaking
script content through SVG images (CVE-2021-43818).
- A vulnerability (GHSL-2021-1037) in the HTML cleaner allowed sneaking
script content through CSS imports and other crafted constructs
(CVE-2021-43818).
https://github.com/lxml/lxml/blob/lxml-4.6.5/CHANGES.txt
Signed-off-by: Fabrice Fontaine <fontaine.fabrice at gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout at mind.be>
---
package/python-lxml/python-lxml.hash | 2 +-
package/python-lxml/python-lxml.mk | 4 ++--
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/package/python-lxml/python-lxml.hash b/package/python-lxml/python-lxml.hash
index dd6446e6cc..e33a8f8109 100644
--- a/package/python-lxml/python-lxml.hash
+++ b/package/python-lxml/python-lxml.hash
@@ -1,5 +1,5 @@
# Locally computed
-sha256 39b78571b3b30645ac77b95f7c69d1bffc4cf8c3b157c435a34da72e78c82468 lxml-4.6.3.tar.gz
+sha256 6e84edecc3a82f90d44ddee2ee2a2630d4994b8471816e226d2b771cda7ac4ca lxml-4.6.5.tar.gz
sha256 41d49dd406aa0e1548a6d5f21a30d6bf638b3cd96eb7289dd348d83ed2e40392 LICENSES.txt
sha256 69edb445c1335a8312d4c09271847e9956d84f0d9f724d125340cc3fad767b2a doc/licenses/BSD.txt
sha256 0497ae8138811ef4466ede653bab7a59feb3d3c14f9ed50fc33a00aeb5bec32e doc/licenses/elementtree.txt
diff --git a/package/python-lxml/python-lxml.mk b/package/python-lxml/python-lxml.mk
index 0d3775a1bd..8c2e965af6 100644
--- a/package/python-lxml/python-lxml.mk
+++ b/package/python-lxml/python-lxml.mk
@@ -4,8 +4,8 @@
#
################################################################################
-PYTHON_LXML_VERSION = 4.6.3
-PYTHON_LXML_SITE = https://files.pythonhosted.org/packages/e5/21/a2e4517e3d216f0051687eea3d3317557bde68736f038a3b105ac3809247
+PYTHON_LXML_VERSION = 4.6.5
+PYTHON_LXML_SITE = https://files.pythonhosted.org/packages/e6/e1/34b3ab08553fe9a30e15b2bb9d1803a49d7d907dd9f245638839190042f0
PYTHON_LXML_SOURCE = lxml-$(PYTHON_LXML_VERSION).tar.gz
# Not including the GPL, because it is used only for the test scripts.
More information about the buildroot
mailing list