Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2022:3934-1

Опубликовано: 10 нояб. 2022
Источник: suse-cvrf

Описание

Security update for python3-lxml

This update for python3-lxml fixes the following issues:

  • CVE-2021-28957: Fixed XSS due to missing input sanitization for HTML5 attributes (bsc#1184177).

Список пакетов

SUSE Linux Enterprise Module for Public Cloud 12
python3-lxml-3.3.5-3.15.1
python3-lxml-doc-3.3.5-3.15.1

Ссылки

Описание

An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS code on users who interact with incorrectly sanitized HTML. This issue is patched in lxml 4.6.3.

Затронутые продукты
SUSE Linux Enterprise Module for Public Cloud 12:python3-lxml-3.3.5-3.15.1
SUSE Linux Enterprise Module for Public Cloud 12:python3-lxml-doc-3.3.5-3.15.1
Ссылки