public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
From: Steve Traylen <steve.traylen@cern.ch>
To: git-commits@fedoraproject.org
Subject: [rpms/python-tablib] epel8: Escape HTML output - CVE-2026-9318 - rhbz#2514473
Date: Tue, 18 Aug 2026 12:27:16 GMT [thread overview]
Message-ID: <178705603616.1.13778697186490759023.rpms-python-tablib-9cd42798cb96@fedoraproject.org> (raw)
A new commit has been pushed.
Repo : rpms/python-tablib
Branch : epel8
Commit : 9cd42798cb96ab61e088bc87c9e3da7855280acb
Author : Steve Traylen <steve.traylen@cern.ch>
Date : 2026-08-18T14:11:03+02:00
Stats : +26/-2 in 2 file(s)
URL : https://src.fedoraproject.org/rpms/python-tablib/c/9cd42798cb96ab61e088bc87c9e3da7855280acb?branch=epel8
Log:
Escape HTML output - CVE-2026-9318 - rhbz#2514473
---
diff --git a/fix-cve-CVE-2026-9318.patch b/fix-cve-CVE-2026-9318.patch
new file mode 100644
index 0000000..aa61557
--- /dev/null
+++ b/fix-cve-CVE-2026-9318.patch
@@ -0,0 +1,20 @@
+diff '--color=auto' -uNr tablib-3.0.0.ORG/src/tablib/formats/_html.py tablib-3.0.0/src/tablib/formats/_html.py
+--- tablib-3.0.0.ORG/src/tablib/formats/_html.py 2026-08-17 20:44:03.911284945 +0200
++++ tablib-3.0.0/src/tablib/formats/_html.py 2026-08-17 20:49:55.152211521 +0200
+@@ -2,6 +2,7 @@
+ """
+
+ import codecs
++import html
+ from io import BytesIO
+
+ from MarkupPy import markup
+@@ -55,7 +56,7 @@
+
+ for i, dset in enumerate(databook._datasets):
+ title = (dset.title if dset.title else 'Set %s' % (i))
+- wrapper.write(f'<{cls.BOOK_ENDINGS}>{title}</{cls.BOOK_ENDINGS}>\n')
++ wrapper.write(f'<{cls.BOOK_ENDINGS}>{html.escape(title)}</{cls.BOOK_ENDINGS}>\n')
+ wrapper.write(dset.html)
+ wrapper.write('\n')
+
diff --git a/python-tablib.spec b/python-tablib.spec
index 4b3f10e..03b60ac 100644
--- a/python-tablib.spec
+++ b/python-tablib.spec
@@ -2,12 +2,16 @@
Name: python-tablib
Version: 3.0.0
-Release: 1%{?dist}
+Release: 2%{?dist}
Summary: Format agnostic tabular data library (XLS, JSON, YAML, CSV)
License: MIT
URL: http://github.com/kennethreitz/tablib
Source0: %{pypi_source}
+# https://github.com/jazzband/tablib/commit/b0ff39fb9b2f457e5332249b4cc2ec11eabf46ee
+# https://github.com/jazzband/tablib/pull/668
+# https://nvd.nist.gov/vuln/detail/CVE-2026-9318
+Patch0: fix-cve-CVE-2026-9318.patch
BuildArch: noarch
%global _description\
@@ -42,7 +46,7 @@ Requires: python3dist(pyyaml)
%description -n python3-%{srcname} %{_description}
%prep
-%autosetup -n %{srcname}-%{version}
+%autosetup -n %{srcname}-%{version} -p1
%build
%py3_build
reply other threads:[~2026-08-18 12:27 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=178705603616.1.13778697186490759023.rpms-python-tablib-9cd42798cb96@fedoraproject.org \
--to=steve.traylen@cern.ch \
--cc=git-commits@fedoraproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox