Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2022:3836-1

Опубликовано: 01 нояб. 2022
Источник: suse-cvrf

Описание

Security update for python-lxml

This update for python-lxml fixes the following issues:

  • CVE-2021-28957: Fixed XSS due to missing input sanitization for HTML5 attributes (bsc#1184177).
  • CVE-2020-27783: Fixed XSS due to the use of improper parser (bsc#1179534).

Список пакетов

openSUSE Leap 15.3
python2-lxml-doc-4.0.0-150000.4.3.1
python3-lxml-doc-4.0.0-150000.4.3.1

Ссылки

Описание

A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behaviors between the sanitizer and the user's page. A remote attacker could exploit this flaw to run arbitrary HTML/JS code.

Затронутые продукты
openSUSE Leap 15.3:python2-lxml-doc-4.0.0-150000.4.3.1
openSUSE Leap 15.3:python3-lxml-doc-4.0.0-150000.4.3.1
Ссылки

Описание

An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS code on users who interact with incorrectly sanitized HTML. This issue is patched in lxml 4.6.3.

Затронутые продукты
openSUSE Leap 15.3:python2-lxml-doc-4.0.0-150000.4.3.1
openSUSE Leap 15.3:python3-lxml-doc-4.0.0-150000.4.3.1
Ссылки