[CLSA-2026:1790237255] Fix CVE(s): CVE-2026-7210
Type:
security
Severity:
Important
Release date:
2026-09-24 08:07:46 UTC
Description:
* SECURITY UPDATE: insufficient entropy in the expat hash salt - debian/patches/CVE-2026-7210.patch: append a dedicated 16-byte expat_hashsalt16 field to _Py_HashSecret_t in Include/object.h, which _PyRandom_Init() seeds along with the rest of the secret, and pass it to libexpat through XML_SetHashSalt16Bytes() in Modules/pyexpat.c and Modules/_elementtree.c when that symbol is available, so the SipHash key libexpat derives is 128 bits instead of the 32 or 64 bits the legacy XML_SetHashSalt() could carry - debian/control, debian/control.in: libpython2.7-stdlib now depends on libexpat1 (>= 2.2.10-2+deb11u7+tuxcare.els3), the first libexpat on this platform to export XML_SetHashSalt16Bytes - CVE-2026-7210
CVEs fixed:
Updated packages:
  • idle-python2.7_2.7.18-8+deb11u1+tuxcare.els4_all.deb
    sha:ca909df2054f2fbaee058f99e9e739b1289f0b8d
  • libpython2.7_2.7.18-8+deb11u1+tuxcare.els4_amd64.deb
    sha:f838c7d0fecac2e766dec8ad24500f20a21c111e
  • libpython2.7-dev_2.7.18-8+deb11u1+tuxcare.els4_amd64.deb
    sha:e8ba4d9348a463c7a5e3bfe7aa5ec2573aa06d37
  • libpython2.7-minimal_2.7.18-8+deb11u1+tuxcare.els4_amd64.deb
    sha:b45d4c034e839145fc4cf33d7d34215072646b32
  • libpython2.7-stdlib_2.7.18-8+deb11u1+tuxcare.els4_amd64.deb
    sha:5546d70d3eeb77c2fabf089dd18316f8e91fcec4
  • libpython2.7-testsuite_2.7.18-8+deb11u1+tuxcare.els4_all.deb
    sha:3ad017d84b244f3fa7b41828578dda4992afaa46
  • python2.7_2.7.18-8+deb11u1+tuxcare.els4_amd64.deb
    sha:01f4f8a78af7fcd4ac554fa6101580828ca37ee1
  • python2.7-dev_2.7.18-8+deb11u1+tuxcare.els4_amd64.deb
    sha:377520b8001c005d857a1143f72ab0a25dab2c67
  • python2.7-doc_2.7.18-8+deb11u1+tuxcare.els4_all.deb
    sha:15366654610ac8e19e99bd9f688d057bd85a8191
  • python2.7-examples_2.7.18-8+deb11u1+tuxcare.els4_all.deb
    sha:49d7778b475fd93fd5c6c378c4a3d6c552866d9b
  • python2.7-minimal_2.7.18-8+deb11u1+tuxcare.els4_amd64.deb
    sha:613bbf6c6aee8db3297544b36c4281f44c134954
  • libpython2.7_2.7.18-8+deb11u1+tuxcare.els4_arm64.deb
    sha:7af4cc87b1995f94d75a5ddcd08c9171bf57ec4f
  • libpython2.7-dev_2.7.18-8+deb11u1+tuxcare.els4_arm64.deb
    sha:aa31959540dafb3ecf27743c2836bec958c856d0
  • libpython2.7-minimal_2.7.18-8+deb11u1+tuxcare.els4_arm64.deb
    sha:6d19b1111ff265968daead8a0963274394cead94
  • libpython2.7-stdlib_2.7.18-8+deb11u1+tuxcare.els4_arm64.deb
    sha:81c991c5ac062cb9641da9ec695314adf670043c
  • python2.7_2.7.18-8+deb11u1+tuxcare.els4_arm64.deb
    sha:0eb946f01fa9df9ecea2c292b31394784800996f
  • python2.7-dev_2.7.18-8+deb11u1+tuxcare.els4_arm64.deb
    sha:e1c59b2d5c37d2ad71ad44e4a5a083d601306f7e
  • python2.7-minimal_2.7.18-8+deb11u1+tuxcare.els4_arm64.deb
    sha:a47b24caf4f28df66ec5af6e1af625c1e4816310
  • libpython2.7_2.7.18-8+deb11u1+tuxcare.els4_armel.deb
    sha:b455fd0e9f101c085db1f308199650ed2a2aede5
  • libpython2.7-dev_2.7.18-8+deb11u1+tuxcare.els4_armel.deb
    sha:a8c3942aa3e521d243199198ef8546c4d20db6fb
  • libpython2.7-minimal_2.7.18-8+deb11u1+tuxcare.els4_armel.deb
    sha:eb474e25af3a8a5639f5872cd3b6e5897af1ad3a
  • libpython2.7-stdlib_2.7.18-8+deb11u1+tuxcare.els4_armel.deb
    sha:e1651d5e515a22e1f70a23cf585ce4bab608bf2d
  • python2.7_2.7.18-8+deb11u1+tuxcare.els4_armel.deb
    sha:abed6de86daa144edc1090a196125875a7ce57ba
  • python2.7-dev_2.7.18-8+deb11u1+tuxcare.els4_armel.deb
    sha:76d50934af409d50538161dd9c2ea0bc6d41dd1c
  • python2.7-minimal_2.7.18-8+deb11u1+tuxcare.els4_armel.deb
    sha:20793279dbc24d2aa2f79e8387e89b72263bb950
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.