Most recent entries from all

ALSA-2021:4151 — Moderate: python27:2.7 security update

Affected: AlmaLinux:8: babel, AlmaLinux:8: python-nose-docs, AlmaLinux:8: python-psycopg2-doc, AlmaLinux:8: python-sqlalchemy-doc, AlmaLinux:8: python2-Cython, AlmaLinux:8: python2-PyMySQL, AlmaLinux:8: python2-attrs, AlmaLinux:8: python2-babel, AlmaLinux:8: python2-backports, AlmaLinux:8: python2-backports-ssl_match_hostname and 42 more

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

* python: Unsafe use of eval() on data retrieved via HTTP in the test suite (CVE-2020-27619)

* python-jinja2: ReDoS vulnerability in the urlize filter (CVE-2020-28493)

* python-babel: Relative path traversal allows attacker to load arbitrary locale files and execute arbitrary code (CVE-2021-20095, CVE-2021-42771)

* python-pygments: Infinite loop in SML lexer may lead to DoS (CVE-2021-20270)

* python: Web cache poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a semicolon in query parameters (CVE-2021-23336)

* python-pygments: ReDoS in multiple lexers (CVE-2021-27291)

* python-lxml: Missing input sanitization for formaction HTML5 attributes may lead to XSS (CVE-2021-28957)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

bdu:2021-03119

Withdrawn: BELL-CVE-2021-28957 — CVE-2021-28957 does not affect BellSoft software

Withdrawn by the publisher.

BREW-ansible-CVE-2021-28957 — lxml vulnerable to Cross-Site Scripting

Affected: Homebrew: ansible

An XSS vulnerability was discovered in the python `lxml` clean module versions before 4.6.3. When disabling `the safe_attrs_only` and `forms` arguments, the `Cleaner` class does not remove the `formaction` attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS code on users who interact with incorrectly sanitized HTML. This issue is patched in `lxml` 4.6.3.

certfr-2023-avi-0142 — De multiples vulnérabilités ont été corrigées dans Splunk. Elles permettent à un attaquant…

certfr-2023-avi-0142

EUVD-2026-263936

fkie_cve-2021-28957

An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS code on users who interact with incorrectly sanitized HTML. This issue is patched in lxml 4.6.3.

GHSA-jq4v-f5q6-mjqq — lxml vulnerable to Cross-Site Scripting

Affected: PyPI: lxml

gsd-2021-28957

msrc_CVE-2021-28957 — An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_…

msrc_CVE-2021-28957

OESA-2021-1178 — python-lxml security update

Affected: openEuler:20.03-LTS-SP1: python-lxml

The lxml XML toolkit is a Pythonic binding for the C libraries libxml2 and libxslt. It is unique in that it combines the speed and XML feature completeness of these libraries with the simplicity of a native Python API, mostly compatible but superior to the well-known ElementTree API. The latest release works with all CPython versions from 2.7 to 3.7. Security Fix(es): An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS code on users who interact with incorrectly sanitized HTML. This issue is patched in lxml 4.6.3.(CVE-2021-28957)

openSUSE-SU-2022:0803-1 — Security update for python-lxml

Security update for python-lxml

PYSEC-2021-19

Affected: PyPI: lxml

RHSA-2021:3254 — Red Hat Security Advisory: rh-python38 security, bug fix, and enhancement update

python-cryptography: Bleichenbacher timing oracle attack against RSA decryption python: Unsafe use of eval() on data retrieved via HTTP in the test suite python-lxml: mXSS due to the use of improper parser python-jinja2: ReDoS vulnerability in the urlize filter python-cryptography: Large inputs for symmetric encryption can trigger integer overflow leading to buffer overflow python: Stack-based buffer overflow in PyCArg_repr in _ctypes/callproc.c python: Information disclosure via pydoc python-pip: Incorrect handling of unicode separators in git references python: urllib: Regular expression DoS in AbstractBasicAuthHandler python: ftplib should not use the host from the PASV response python-babel: Relative path traversal allows attacker to load arbitrary locale files and execute arbitrary code python: Web cache poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a semicolon in query parameters python-lxml: Missing input sanitization for formaction HTML5 attributes may lead to XSS python-ipaddress: Improper input validation of octal strings python-urllib3: ReDoS in the parsing of authority part of URL python-babel: Relative path traversal allows attacker to load arbitrary locale files and execute arbitrary code python: urllib.parse does not sanitize URLs containing ASCII newline and tabs

SUSE-SU-2022:0803-1 — Security update for python-lxml

Security update for python-lxml

UBUNTU-CVE-2021-28957

Affected: Ubuntu:Pro:14.04:LTS: lxml, Ubuntu:16.04:LTS: lxml, Ubuntu:18.04:LTS: lxml, Ubuntu:20.04:LTS: lxml

WID-SEC-W-2022-0571 — Red Hat Enterprise Linux: Mehrere Schwachstellen

Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um einen Cross-Site-Scripting-Angriff durchzuführen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuführen, Sicherheitsmaßnahmen zu umgehen, beliebigen Code auszuführen, Dateien zu manipulieren und einen nicht spezifizierten Angriff durchzuführen.