On Sun Jul 19, 2026 at 11:48 PM CEST, Yoann Congal wrote: > Hello, > > On Mon Jul 6, 2026 at 3:26 PM CEST, Amaury Couderc via lists.openembedded.org > wrote: >> From: Amaury Couderc <[email protected]> >> >> CVE-2026-7210 is a hash-flooding denial-of-service vulnerability in >> Python's XML parsing modules (xml.parsers.expat, xml.etree.ElementTree). >> An attacker can craft XML input that forces O(n²) hash collisions in >> libexpat's internal name dictionary, causing excessive CPU consumption. >> >> The previous mitigation seeded libexpat's hash function with only 4 >> bytes of entropy, which is insufficient against a determined attacker. >> This patch upgrades to XML_SetHashSalt16Bytes (libexpat >= 2.8.0), >> providing a full 16-byte secret. Older expat versions fall back >> gracefully to the legacy XML_SetHashSalt via a runtime NULL check. >> >> Backport patch to fix CVE-2026-7210. >> https://nvd.nist.gov/vuln/detail/CVE-2026-7210 >> >> Upstream fix: >> >> https://github.com/python/cpython/commit/24b8f12544468e4cedf5bfbe25442fcd495391e4 >> >> Tested with ptest: >> Before: PASSED: 40019, FAILED: 0, SKIPPED: 1882 >> After: PASSED: 40020, FAILED: 0, SKIPPED: 1882 >> >> CVE: CVE-2026-7210 >> >> Signed-off-by: Amaury Couderc <[email protected]> >> --- >> >> NOTE: CVE-2026-7210 full mitigation requires the companion >> expat CVE-2026-41080 patch (raises expat to >= 2.8.0 API) >> >> .../python/python3/CVE-2026-7210.patch | 122 ++++++++++++++++++ >> .../python/python3_3.12.13.bb | 1 + >> 2 files changed, 123 insertions(+) >> create mode 100644 meta/recipes-devtools/python/python3/CVE-2026-7210.patch >> >> diff --git a/meta/recipes-devtools/python/python3/CVE-2026-7210.patch >> b/meta/recipes-devtools/python/python3/CVE-2026-7210.patch >> new file mode 100644 >> index 0000000000..8acf174a0a >> --- /dev/null >> +++ b/meta/recipes-devtools/python/python3/CVE-2026-7210.patch >> @@ -0,0 +1,122 @@ >> +From 2ed6138dea0bc94c726f879501e4525712e885d1 Mon Sep 17 00:00:00 2001 >> +From: Stan Ulbrych <[email protected]> >> +Date: Sun, 10 May 2026 18:36:26 +0100 >> +Subject: [PATCH] gh-149018: Use `XML_SetHashSalt16Bytes` in >> + `pyexpat`/`_elementtree` when possible (#149023) >> + >> + >> +CVE: CVE-2026-7210 >> +Upstream-Status: Backport >> [https://github.com/python/cpython/commit/24b8f12544468e4cedf5bfbe25442fcd495391e4] >> + >> +Signed-off-by: Amaury Couderc <[email protected]> >> +--- >> + Include/pyexpat.h | 3 +++ >> + Include/pyhash.h | 8 +++++--- >> + .../2026-04-26-19-30-45.gh-issue-149018.a9SqWb.rst | 3 +++ >> + Modules/_elementtree.c | 8 ++++++-- >> + Modules/pyexpat.c | 10 +++++++++- >> + 5 files changed, 26 insertions(+), 6 deletions(-) >> + create mode 100644 >> Misc/NEWS.d/next/Security/2026-04-26-19-30-45.gh-issue-149018.a9SqWb.rst > > The patched files have slighty changed > Include/internal/pycore_pyhash.h -> Include/pyhash.h > This time, I could check that nothing important changed but next time > I'd like a like a little change log about what changed between upstream > and the imported patch. > >> [...] >> +diff --git a/Modules/pyexpat.c b/Modules/pyexpat.c >> +index 79492ca5c4f..388473d3855 100644 >> +--- a/Modules/pyexpat.c >> ++++ b/Modules/pyexpat.c >> +@@ -1388,7 +1388,10 @@ newxmlparseobject(pyexpat_state *state, const char >> *encoding, >> + Py_DECREF(self); >> + return NULL; >> + } >> +-#if XML_COMBINED_VERSION >= 20100 >> ++#if XML_COMBINED_VERSION >= 20800 >> ++ /* This feature was added upstream in libexpat 2.8.0. */ >> ++ XML_SetHashSalt16Bytes(self->itself, _Py_HashSecret.expat.hashsalt16); >> ++#elif XML_COMBINED_VERSION >= 20100 >> + /* This feature was added upstream in libexpat 2.1.0. */ >> + XML_SetHashSalt(self->itself, >> + (unsigned long)_Py_HashSecret.expat.hashsalt); >> +@@ -2257,6 +2260,11 @@ pyexpat_exec(PyObject *mod) >> + #else >> + capi->SetHashSalt = NULL; >> + #endif >> ++#if XML_COMBINED_VERSION >= 20800 >> ++ capi->SetHashSalt16Bytes = XML_SetHashSalt16Bytes; >> ++#else >> ++ capi->SetHashSalt16Bytes = NULL; >> ++#endif >> + #if XML_COMBINED_VERSION >= 20600 >> + capi->SetReparseDeferralEnabled = XML_SetReparseDeferralEnabled; >> + #else > > We did not upgrade expat but patched in the fixing API > XML_SetHashSalt16Bytes. Can you check we can activate the fixed code > path with those "#if XML_COMBINED_VERSION >= 20800"? > > I will hold the patch in the meantime, I really want to avoid a false > negative in CVE data.
Hello, Gentle ping for the above Regards, -- Yoann Congal Smile ECS
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#244210): https://lists.openembedded.org/g/openembedded-core/message/244210 Mute This Topic: https://lists.openembedded.org/mt/120139168/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
