Most recent entries from all

bdu:2021-03144

BREW-jupyterlab-CVE-2021-23980 — Cross-site scripting in Bleach

Affected: Homebrew: jupyterlab

### Impact

A [mutation XSS](https://cure53.de/fp170.pdf) affects users calling `bleach.clean` with all of:

* `svg` or `math` in the allowed tags * `p` or `br` in allowed tags * `style`, `title`, `noscript`, `script`, `textarea`, `noframes`, `iframe`, or `xmp` in allowed tags * the keyword argument `strip_comments=False`

Note: none of the above tags are in the default allowed tags and `strip_comments` defaults to `True`.

### Patches

Users are encouraged to upgrade to bleach v3.3.0 or greater.

Note: bleach v3.3.0 introduces a breaking change to escape HTML comments by default.

### Workarounds

* modify `bleach.clean` calls to at least one of: * not allow the `style`, `title`, `noscript`, `script`, `textarea`, `noframes`, `iframe`, or `xmp` tag * not allow `svg` or `math` tags * not allow `p` or `br` tags * set `strip_comments=True`

* A strong [Content-Security-Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) without `unsafe-inline` and `unsafe-eval` [`script-src`s](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src)) will also help mitigate the risk.

### References

* https://bugzilla.mozilla.org/show_bug.cgi?id=1689399 * https://advisory.checkmarx.net/advisory/CX-2…

EUVD-2026-223586

fkie_cve-2021-23980

A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.

GHSA-vv2x-vrpj-qqpq — Cross-site scripting in Bleach

Affected: PyPI: bleach

### Impact

A [mutation XSS](https://cure53.de/fp170.pdf) affects users calling `bleach.clean` with all of:

Note: none of the above tags are in the default allowed tags and `strip_comments` defaults to `True`.

### Patches

Users are encouraged to upgrade to bleach v3.3.0 or greater.

Note: bleach v3.3.0 introduces a breaking change to escape HTML comments by default.

### Workarounds

### References

* https://bugzilla.mozilla.org/show_bug.cgi?id=1689399 * https://advisory.checkmarx.net/advisory/CX-2…

gsd-2021-23980

msrc_CVE-2021-23980 — A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags…

msrc_CVE-2021-23980

OESA-2022-1861 — python-bleach security update

Affected: openEuler:22.03-LTS: python-bleach

Bleach is an HTML sanitizing library that escapes or strips markup and attributes based on a white list. Security Fix(es): No description is available for this CVE.(CVE-2021-23980)

openSUSE-SU-2021:0552-1 — Security update for python-bleach

Security update for python-bleach

PYSEC-2021-865

Affected: PyPI: bleach

In Mozilla Bleach before 3.3.0, a mutation XSS affects users calling bleach.clean with math or svg; p or br; and style, title, noscript, script, textarea, noframes, iframe, or xmp tags with strip_comments=False.

RHSA-2021:0781 — Red Hat Security Advisory: Red Hat Ansible Automation Platform 1.2.2 security and bug fix update

nodejs-node-notifier: command injection due to the options params not being sanitised when being passed an array nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function django: Potential directory-traversal via archive.extract() python-pygments: Infinite loop in SML lexer may lead to DoS python-bleach: Mutation cross-site scripting in bleach.clean python-pygments: ReDoS in multiple lexers

UBUNTU-CVE-2021-23980

Affected: Ubuntu:Pro:16.04:LTS: python-bleach, Ubuntu:Pro:18.04:LTS: python-bleach, Ubuntu:Pro:20.04:LTS: python-bleach