Most recent entries from all

ALSA-2021:1761 — Moderate: python27:2.7 security and bug fix update

Affected: AlmaLinux:8: python-psycopg2-doc, AlmaLinux:8: python-sqlalchemy-doc, AlmaLinux:8: python2-Cython, AlmaLinux:8: python2-PyMySQL, AlmaLinux:8: python2-attrs, AlmaLinux:8: python2-backports, AlmaLinux:8: python2-backports-ssl_match_hostname, AlmaLinux:8: python2-chardet, AlmaLinux:8: python2-coverage, AlmaLinux:8: python2-dns and 29 more

Python is an interpreted, interactive, object-oriented programming language that supports modules, classes, exceptions, high-level dynamic data types, and dynamic typing. The python27 packages provide a stable release of Python 2.7 with a number of additional utilities and database connectors for MySQL and PostgreSQL.

Security Fix(es):

* python: CRLF injection via HTTP request method in httplib/http.client (CVE-2020-26116)

* python-urllib3: CRLF injection via HTTP request method (CVE-2020-26137)

* python-lxml: mXSS due to the use of improper parser (CVE-2020-27783)

* python: Stack-based buffer overflow in PyCArg_repr in _ctypes/callproc.c (CVE-2021-3177)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

bdu:2021-03620

Withdrawn: BELL-CVE-2020-27783 — CVE-2020-27783 does not affect BellSoft software

Withdrawn by the publisher.

BREW-ansible-CVE-2020-27783 — lxml vulnerable to Cross-site Scripting

Affected: Homebrew: ansible

A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behaviors between the sanitizer and the user's page. A remote attacker could exploit this flaw to run arbitrary HTML/JS code.

certfr-2021-avi-791 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2021-avi-791

EUVD-2026-263919

fkie_cve-2020-27783

GHSA-pgww-xf46-h92r — lxml vulnerable to Cross-site Scripting

Affected: PyPI: lxml

gsd-2020-27783

msrc_CVE-2020-27783 — A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers…

msrc_CVE-2020-27783

OESA-2021-1068 — python-lxml security update

Affected: openEuler:20.03-LTS: python-lxml, openEuler:20.03-LTS-SP1: python-lxml

The lxml XML toolkit is a Pythonic binding for the C libraries libxml2 and libxslt. It is unique in that it combines the speed and XML feature completeness of these libraries with the simplicity of a native Python API, mostly compatible but superior to the well-known ElementTree API. The latest release works with all CPython versions from 2.7 to 3.7. Security Fix(es): A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behaviors between the sanitizer and the user's page. A remote attacker could exploit this flaw to run arbitrary HTML/JS code.(CVE-2020-27783)

openSUSE-SU-2022:0803-1 — Security update for python-lxml

Security update for python-lxml

PYSEC-2020-62

Affected: PyPI: lxml

RHSA-2021:3254 — Red Hat Security Advisory: rh-python38 security, bug fix, and enhancement update

python-cryptography: Bleichenbacher timing oracle attack against RSA decryption python: Unsafe use of eval() on data retrieved via HTTP in the test suite python-lxml: mXSS due to the use of improper parser python-jinja2: ReDoS vulnerability in the urlize filter python-cryptography: Large inputs for symmetric encryption can trigger integer overflow leading to buffer overflow python: Stack-based buffer overflow in PyCArg_repr in _ctypes/callproc.c python: Information disclosure via pydoc python-pip: Incorrect handling of unicode separators in git references python: urllib: Regular expression DoS in AbstractBasicAuthHandler python: ftplib should not use the host from the PASV response python-babel: Relative path traversal allows attacker to load arbitrary locale files and execute arbitrary code python: Web cache poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a semicolon in query parameters python-lxml: Missing input sanitization for formaction HTML5 attributes may lead to XSS python-ipaddress: Improper input validation of octal strings python-urllib3: ReDoS in the parsing of authority part of URL python-babel: Relative path traversal allows attacker to load arbitrary locale files and execute arbitrary code python: urllib.parse does not sanitize URLs containing ASCII newline and tabs

SUSE-SU-2022:0803-1 — Security update for python-lxml

Security update for python-lxml

UBUNTU-CVE-2020-27783

Affected: Ubuntu:Pro:14.04:LTS: lxml, Ubuntu:16.04:LTS: lxml, Ubuntu:18.04:LTS: lxml, Ubuntu:20.04:LTS: lxml

WID-SEC-W-2022-0931 — Red Hat Enterprise Linux (python-lxml): Schwachstelle ermöglicht Cross-Site Scripting

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux im python-lxml Modul ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.