chore(deps): refresh rpm lockfiles [SECURITY]

[red-hat-konflux]

This PR contains the following updates:

File bundle-patch/rpms.in.yaml:

Package	Change
expat	2.2.5-17.el8_10 -> 2.5.0-1.el8_10
platform-python	3.6.8-70.el8_10 -> 3.6.8-73.el8_10
python3-libs	3.6.8-70.el8_10 -> 3.6.8-73.el8_10

---

libexpat: expat: Improper Restriction of XML Entity Expansion Depth in libexpat

CVE-2024-8176

More information

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2024-8176
• https://bugzilla.redhat.com/show_bug.cgi?id=2310137
• https://www.cve.org/CVERecord?id=CVE-2024-8176
• https://nvd.nist.gov/vuln/detail/CVE-2024-8176
• https://github.com/libexpat/libexpat/issues/893

---

expat: integer overflow in the doProlog function

CVE-2022-23990

More information

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2022-23990
• https://bugzilla.redhat.com/show_bug.cgi?id=2048356
• https://www.cve.org/CVERecord?id=CVE-2022-23990
• https://nvd.nist.gov/vuln/detail/CVE-2022-23990

---

expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing

CVE-2025-59375

More information

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2025-59375
• https://bugzilla.redhat.com/show_bug.cgi?id=2395108
• https://www.cve.org/CVERecord?id=CVE-2025-59375
• https://nvd.nist.gov/vuln/detail/CVE-2025-59375
• https://github.com/libexpat/libexpat/blob/676a4c531ec768732fac215da9730b5f50fbd2bf/expat/Changes#L45-L74
• https://github.com/libexpat/libexpat/issues/1018
• https://github.com/libexpat/libexpat/pull/1034
• https://issues.oss-fuzz.com/issues/439133977

---

expat: parsing large tokens can trigger a denial of service

CVE-2023-52425

More information

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2023-52425
• https://bugzilla.redhat.com/show_bug.cgi?id=2262877
• https://www.cve.org/CVERecord?id=CVE-2023-52425
• https://nvd.nist.gov/vuln/detail/CVE-2023-52425

---

expat: heap-based buffer over-read via crafted XML input

CVE-2019-15903

More information

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2019-15903
• https://bugzilla.redhat.com/show_bug.cgi?id=1752592
• https://www.cve.org/CVERecord?id=CVE-2019-15903
• https://nvd.nist.gov/vuln/detail/CVE-2019-15903

---

expat: internal entity expansion

CVE-2013-0340

More information

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2013-0340
• https://bugzilla.redhat.com/show_bug.cgi?id=1000109
• https://www.cve.org/CVERecord?id=CVE-2013-0340
• https://nvd.nist.gov/vuln/detail/CVE-2013-0340

---

expat: Integer overflow in defineAttribute in xmlparse.c

CVE-2022-22824

More information

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2022-22824
• https://bugzilla.redhat.com/show_bug.cgi?id=2044467
• https://www.cve.org/CVERecord?id=CVE-2022-22824
• https://nvd.nist.gov/vuln/detail/CVE-2022-22824
• https://github.com/libexpat/libexpat/pull/539

---

expat: Integer overflow in nextScaffoldPart in xmlparse.c

CVE-2022-22826

More information

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2022-22826
• https://bugzilla.redhat.com/show_bug.cgi?id=2044484
• https://www.cve.org/CVERecord?id=CVE-2022-22826
• https://nvd.nist.gov/vuln/detail/CVE-2022-22826
• https://github.com/libexpat/libexpat/pull/539

---

expat: use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate

CVE-2022-43680

More information

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2022-43680
• https://bugzilla.redhat.com/show_bug.cgi?id=2140059
• https://www.cve.org/CVERecord?id=CVE-2022-43680
• https://nvd.nist.gov/vuln/detail/CVE-2022-43680
• https://github.com/libexpat/libexpat/issues/649

---

expat: Integer overflow in storeAtts in xmlparse.c

CVE-2022-22827

More information

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2022-22827
• https://bugzilla.redhat.com/show_bug.cgi?id=2044488
• https://www.cve.org/CVERecord?id=CVE-2022-22827
• https://nvd.nist.gov/vuln/detail/CVE-2022-22827
• https://github.com/libexpat/libexpat/pull/539

---

expat: XML Entity Expansion

CVE-2024-28757

More information

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2024-28757
• https://bugzilla.redhat.com/show_bug.cgi?id=2268766
• https://www.cve.org/CVERecord?id=CVE-2024-28757
• https://nvd.nist.gov/vuln/detail/CVE-2024-28757
• https://github.com/libexpat/libexpat/issues/839

---

expat: Integer overflow in copyString()

CVE-2022-25314

More information

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2022-25314
• https://bugzilla.redhat.com/show_bug.cgi?id=2056354
• https://www.cve.org/CVERecord?id=CVE-2022-25314
• https://nvd.nist.gov/vuln/detail/CVE-2022-25314
• https://blog.hartwork.org/posts/expat-2-4-5-released/

---

expat: Integer overflow in lookup in xmlparse.c

CVE-2022-22825

More information

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2022-22825
• https://bugzilla.redhat.com/show_bug.cgi?id=2044479
• https://www.cve.org/CVERecord?id=CVE-2022-22825
• https://nvd.nist.gov/vuln/detail/CVE-2022-22825
• https://github.com/libexpat/libexpat/pull/539

---

expat: Integer overflow in addBinding in xmlparse.c

CVE-2022-22822

More information

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2022-22822
• https://bugzilla.redhat.com/show_bug.cgi?id=2044457
• https://www.cve.org/CVERecord?id=CVE-2022-22822
• https://nvd.nist.gov/vuln/detail/CVE-2022-22822
• https://github.com/libexpat/libexpat/pull/539

---

expat: Integer overflow in build_model in xmlparse.c

CVE-2022-22823

More information

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2022-22823
• https://bugzilla.redhat.com/show_bug.cgi?id=2044464
• https://www.cve.org/CVERecord?id=CVE-2022-22823
• https://nvd.nist.gov/vuln/detail/CVE-2022-22823
• https://github.com/libexpat/libexpat/pull/539

---

expat: Stack exhaustion in doctype parsing

CVE-2022-25313

More information

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2022-25313
• https://bugzilla.redhat.com/show_bug.cgi?id=2056350
• https://www.cve.org/CVERecord?id=CVE-2022-25313
• https://nvd.nist.gov/vuln/detail/CVE-2022-25313
• https://blog.hartwork.org/posts/expat-2-4-5-released/

---

expat: Integer overflow in doProlog in xmlparse.c

CVE-2021-46143

More information

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2021-46143
• https://bugzilla.redhat.com/show_bug.cgi?id=2044455
• https://www.cve.org/CVERecord?id=CVE-2021-46143
• https://nvd.nist.gov/vuln/detail/CVE-2021-46143
• https://github.com/libexpat/libexpat/issues/532

---

expat: large number of colons in input makes parser consume high amount of resources, leading to DoS

CVE-2018-20843

More information

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2018-20843
• https://bugzilla.redhat.com/show_bug.cgi?id=1723723
• https://www.cve.org/CVERecord?id=CVE-2018-20843
• https://nvd.nist.gov/vuln/detail/CVE-2018-20843
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=931031

---

expat: Large number of prefixed XML attributes on a single tag can crash libexpat

CVE-2021-45960

More information

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2021-45960
• https://bugzilla.redhat.com/show_bug.cgi?id=2044451
• https://www.cve.org/CVERecord?id=CVE-2021-45960
• https://nvd.nist.gov/vuln/detail/CVE-2021-45960
• https://github.com/libexpat/libexpat/issues/531

---

cpython: POP3 command injection in user-controlled commands

CVE-2025-15367

More information

Severity

Moderate

References

• https://access.redhat.com/security/cve/CVE-2025-15367
• https://bugzilla.redhat.com/show_bug.cgi?id=2431373
• https://www.cve.org/CVERecord?id=CVE-2025-15367
• https://nvd.nist.gov/vuln/detail/CVE-2025-15367
• https://github.com/python/cpython/issues/143923
• https://github.com/python/cpython/pull/143924
• https://mail.python.org/archives/list/security-announce@python.org/thread/CBFBOWVGGUJFSGITQCCBZS4GEYYZ7ZNE/

---

cpython: IMAP command injection in user-controlled commands

CVE-2025-15366

More information

Severity

Moderate

References

• https://access.redhat.com/security/cve/CVE-2025-15366
• https://bugzilla.redhat.com/show_bug.cgi?id=2431368
• https://www.cve.org/CVERecord?id=CVE-2025-15366
• https://nvd.nist.gov/vuln/detail/CVE-2025-15366
• https://github.com/python/cpython/issues/143921
• https://github.com/python/cpython/pull/143922
• https://mail.python.org/archives/list/security-announce@python.org/thread/DD7C7JZJYTBXMDOWKCEIEBJLBRU64OMR/

---

cpython: python: cpython: Quadratic algorithm in xml.dom.minidom leads to denial of service

CVE-2025-12084

More information

Severity

Moderate

References

• https://access.redhat.com/security/cve/CVE-2025-12084
• https://bugzilla.redhat.com/show_bug.cgi?id=2418655
• https://www.cve.org/CVERecord?id=CVE-2025-12084
• https://nvd.nist.gov/vuln/detail/CVE-2025-12084
• https://github.com/python/cpython/issues/142145
• https://github.com/python/cpython/pull/142146

---

cpython: email header injection due to unquoted newlines

CVE-2026-1299

More information

Severity

Moderate

References

• https://access.redhat.com/security/cve/CVE-2026-1299
• https://bugzilla.redhat.com/show_bug.cgi?id=2432437
• https://www.cve.org/CVERecord?id=CVE-2026-1299
• https://nvd.nist.gov/vuln/detail/CVE-2026-1299
• https://cve.org/CVERecord?id=CVE-2024-6923
• https://github.com/python/cpython/commit/052e55e7d44718fe46cbba0ca995cb8fcc359413
• https://github.com/python/cpython/issues/144125
• https://github.com/python/cpython/pull/144126
• https://mail.python.org/archives/list/security-announce@python.org/thread/6ZZULGALJTITEAGEXLDJE2C6FORDXPBT/

---

cpython: wsgiref.headers.Headers allows header newline injection in Python

CVE-2026-0865

More information

Severity

Moderate

References

• https://access.redhat.com/security/cve/CVE-2026-0865
• https://bugzilla.redhat.com/show_bug.cgi?id=2431367
• https://www.cve.org/CVERecord?id=CVE-2026-0865
• https://nvd.nist.gov/vuln/detail/CVE-2026-0865
• https://github.com/python/cpython/issues/143916
• https://github.com/python/cpython/pull/143917
• https://mail.python.org/archives/list/security-announce@python.org/thread/BJ6QPHNSHJTS3A7CFV6IBMCAP2DWRVNT/

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.