Security fix for CVE-2022-2309

Resolves: rhbz#2107571

python-lxml.spec

@@ -2,7 +2,7 @@
 
 Name:           python-%{modname}
 Version:        4.7.1
-Release:        2%{?dist}
+Release:        3%{?dist}
 Summary:        XML processing library combining libxml2/libxslt with the ElementTree API
 
 # The lxml project is licensed under BSD
@@ -13,6 +13,13 @@ License:        BSD and MIT and zlib
 URL:            https://github.com/lxml/lxml
 Source0:        %{pypi_source %{modname}}
 
+# Security fix for CVE-2022-2309
+# Resolved upstream:
+# https://github.com/lxml/lxml/commit/86368e9cf70a0ad23cccd5ee32de847149af0c6f
+# https://github.com/lxml/lxml/commit/d01872ccdf7e1e5e825b6c6292b43e7d27ae5fc4
+# https://github.com/lxml/lxml/commit/c742576c105f40fc8b754fcae56fee4aa35840a3
+Patch:          CVE-2022-2309.patch
+
 BuildRequires:  gcc
 BuildRequires:  libxml2-devel
 BuildRequires:  libxslt-devel
@@ -65,6 +72,10 @@ cp -a build/lib.%{python3_platform}-%{python3_version}/* src/
 %{python3_sitearch}/%{modname}-*.egg-info/
 
 %changelog
+* Thu Sep 15 2022 Charalampos Stratakis <cstratak@redhat.com> - 4.7.1-3
+- Security fix for CVE-2022-2309
+- Resolves: rhbz#2107571
+
 * Fri Jan 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 4.7.1-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild