diff --git a/boto/ecs/item.py b/boto/ecs/item.py
index 79177a31d4..7f19b918e7 100644
--- a/boto/ecs/item.py
+++ b/boto/ecs/item.py
@@ -21,7 +21,7 @@
 
 
 import xml.sax
-import cgi
+import html
 from boto.compat import six, StringIO
 
 class ResponseGroup(xml.sax.ContentHandler):
@@ -67,7 +67,7 @@ def startElement(self, name, attrs, connection):
         return None
 
     def endElement(self, name, value, connection):
-        self._xml.write("%s</%s>" % (cgi.escape(value).replace("&amp;amp;", "&amp;"), name))
+        self._xml.write("%s</%s>" % (html.escape(value, quote=False).replace("&amp;amp;", "&amp;"), name))
         if len(self._nodepath) == 0:
             return
         obj = None
diff --git a/python-boto.spec b/python-boto.spec
index 784d90ecc0..b15ed26b75 100644
--- a/python-boto.spec
+++ b/python-boto.spec
@@ -1,6 +1,6 @@
 %{!?__python3: %global __python3 /usr/bin/python3}
 %{!?python3_sitelib: %global python3_sitelib %(%{__python3} -c "from distutils.sysconfig import get_python_lib; print(get_python_lib())")}
-%if 0%{?el8}
+%if 0%{?rhel} == 8 || 0%{?redos} == 7
 %global el_python3_pkgversion 3
 %else
 %global el_python3_pkgversion 36
@@ -21,7 +21,7 @@ cloud systems like Eucalyptus, OpenStack and Open Nebula.
 Summary:        A simple, lightweight interface to Amazon Web Services
 Name:           python-%{pkgname}
 Version:        2.46.1
-Release:        CROC48%{?buildid}%{?dist}
+Release:        CROC49%{?buildid}%{?dist}
 License:        MIT
 Group:          Development/Languages
 URL:            https://github.com/c2devel/boto
@@ -67,6 +67,11 @@ rm -f %buildroot/%{_bindir}/*
 
 
 %changelog
+* Thu Dec 21 2023 Ivan Konov <ikonov@croc.ru> - 2.46.1-CROC49
+- tests: add parameter required since py3.8 to hmac.new() calls
+- tests: replace deprecated cgi.escape() with html.escape()
+- spec: fixes for redos build
+
 * Thu Oct 12 2023 Grigoriy Kulagin <grkulagin@croc.ru> - 2.46.1-CROC48
 - .github: remove old py version checks
 - ec2: add os and new instance type format
diff --git a/tests/db/test_password.py b/tests/db/test_password.py
index 74c3409526..44ad7ded54 100644
--- a/tests/db/test_password.py
+++ b/tests/db/test_password.py
@@ -24,6 +24,9 @@
 import logging
 import time
 
+from hashlib import md5
+
+
 log= logging.getLogger('password_property_test')
 log.setLevel(logging.DEBUG)
 
@@ -37,7 +40,7 @@ def tearDown(self):
     def hmac_hashfunc(self):
         import hmac
         def hashfunc(msg):
-            return hmac.new('mysecret', msg)
+            return hmac.new('mysecret', msg, digestmod=md5)
         return hashfunc
 
     def test_model(self,hashfunc=None):
@@ -98,7 +101,7 @@ def test_aaa_default_password_property(self):
 
     def test_password_constructor_hashfunc(self):
         import hmac
-        myhashfunc=lambda msg: hmac.new('mysecret', msg)
+        myhashfunc=lambda msg: hmac.new('mysecret', msg, digestmod=md5)
         cls = self.test_model(hashfunc=myhashfunc)
         obj = cls()
         obj.password='hello'
diff --git a/tests/unit/utils/test_utils.py b/tests/unit/utils/test_utils.py
index db15b56d58..d2e8dfb37b 100644
--- a/tests/unit/utils/test_utils.py
+++ b/tests/unit/utils/test_utils.py
@@ -85,7 +85,7 @@ def test_hmac(self):
         def hmac_hashfunc(cls, msg):
             if not isinstance(msg, bytes):
                 msg = msg.encode('utf-8')
-            return hmac.new(b'mysecretkey', msg)
+            return hmac.new(b'mysecretkey', msg, digestmod=hashlib.md5)
 
         class HMACPassword(Password):
             hashfunc = hmac_hashfunc
@@ -95,15 +95,15 @@ class HMACPassword(Password):
         password.set('foo')
 
         self.assertEquals(str(password),
-                          hmac.new(b'mysecretkey', b'foo').hexdigest())
+                          hmac.new(b'mysecretkey', b'foo', digestmod=hashlib.md5).hexdigest())
 
     def test_constructor(self):
-        hmac_hashfunc = lambda msg: hmac.new(b'mysecretkey', msg)
+        hmac_hashfunc = lambda msg: hmac.new(b'mysecretkey', msg, digestmod=hashlib.md5)
 
         password = Password(hashfunc=hmac_hashfunc)
         password.set('foo')
         self.assertEquals(password.str,
-                          hmac.new(b'mysecretkey', b'foo').hexdigest())
+                          hmac.new(b'mysecretkey', b'foo', digestmod=hashlib.md5).hexdigest())
 
 
 class TestPythonizeName(unittest.TestCase):