Package
awx
Component
lxml
Latest update
Fixed version
24.6.1-r49
7.5
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Fixed version
24.6.1-r49Status
Impact
awx 24.6.1 pins lxml==4.9.4 via the upstream requirements/requirements.txt (https://github.com/ansible/awx/blob/24.6.1/requirements/requirements.txt). The fix for this CVE ships in lxml 6.1.0, which is a two-major-version bump from 4.x to 6.x.
Beyond the version delta, the security fix itself changes lxml's default behavior — iterparse() and ETCompatXMLParser() now disable external entity resolution by default. That is the desired hardening, but it is also a behavior change that may affect awx XML-handling call sites (SAML auth, inventory plugins, exports). Carrying the bump as a Wolfi-only override without upstream verification risks regressing legitimate XML callers.
Awaiting upstream awx to bump lxml past 6.1.0 in their requirements; the fix will land here once that bump ships in a tagged awx release.
Status
Status
Fixed version
24.6.1-r34Status