Most recent entries from all

ALSA-2022:1763 — Moderate: python39:3.9 and python39-devel:3.9 security update

Affected: AlmaLinux:8: python39, AlmaLinux:8: python39-Cython, AlmaLinux:8: python39-PyMySQL, AlmaLinux:8: python39-attrs, AlmaLinux:8: python39-cffi, AlmaLinux:8: python39-chardet, AlmaLinux:8: python39-cryptography, AlmaLinux:8: python39-debug, AlmaLinux:8: python39-devel, AlmaLinux:8: python39-idle and 39 more

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

* python-lxml: HTML Cleaner allows crafted and SVG embedded scripts to pass through (CVE-2021-43818)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

bdu:2022-00756

Withdrawn: BELL-CVE-2021-43818 — CVE-2021-43818 does not affect BellSoft software

Withdrawn by the publisher.

BREW-ansible-CVE-2021-43818 — lxml's HTML Cleaner allows crafted and SVG embedded scripts to pass through

Affected: Homebrew: ansible

### Impact The HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG files embedded using data URIs.

Users that employ the HTML cleaner in a security relevant context should upgrade to lxml 4.6.5.

### Patches The issue has been resolved in lxml 4.6.5.

### Workarounds None.

### References The issues are tracked under the report IDs GHSL-2021-1037 and GHSL-2021-1038.

certfr-2024-avi-0262 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre el…

certfr-2024-avi-0262

cnvd-2021-100235

EUVD-2026-263982

fkie_cve-2021-43818

lxml is a library for processing XML and HTML in the Python language. Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG files embedded using data URIs. Users that employ the HTML cleaner in a security relevant context should upgrade to lxml 4.6.5 to receive a patch. There are no known workarounds available.

GHSA-55x5-fj6c-h6m8 — lxml's HTML Cleaner allows crafted and SVG embedded scripts to pass through

Affected: PyPI: lxml

### Impact The HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG files embedded using data URIs.

Users that employ the HTML cleaner in a security relevant context should upgrade to lxml 4.6.5.

### Patches The issue has been resolved in lxml 4.6.5.

### Workarounds None.

### References The issues are tracked under the report IDs GHSL-2021-1037 and GHSL-2021-1038.

gsd-2021-43818

msrc_CVE-2021-43818 — HTML Cleaner allows crafted and SVG embedded scripts to pass through

msrc_CVE-2021-43818

OESA-2022-1482 — python-lxml security update

Affected: openEuler:20.03-LTS-SP1: python-lxml, openEuler:20.03-LTS-SP2: python-lxml, openEuler:20.03-LTS-SP3: python-lxml

XML processing library combining libxml2/libxslt with the ElementTree API. Security Fix(es): lxml is a library for processing XML and HTML in the Python language. Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG files embedded using data URIs. Users that employ the HTML cleaner in a security relevant context should upgrade to lxml 4.6.5 to receive a patch. There are no known workarounds available.(CVE-2021-43818)

openSUSE-SU-2022:0803-1 — Security update for python-lxml

Security update for python-lxml

PYSEC-2021-852

Affected: PyPI: lxml

RHSA-2022:1664 — Red Hat Security Advisory: Red Hat Software Collections security update

python-lxml: HTML Cleaner allows crafted and SVG embedded scripts to pass through

SUSE-SU-2022:0803-1 — Security update for python-lxml

Security update for python-lxml

UBUNTU-CVE-2021-43818

Affected: Ubuntu:Pro:14.04:LTS: lxml, Ubuntu:Pro:16.04:LTS: lxml, Ubuntu:18.04:LTS: lxml, Ubuntu:20.04:LTS: lxml, Ubuntu:22.04:LTS: lxml

WID-SEC-W-2022-0302 — Xerox FreeFlow Print Server: Mehrere Schwachstellen ermöglichen Ausführen von beliebigem Programmcode mit Administrator…

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Xerox FreeFlow Print Server ausnutzen, um beliebigen Programmcode auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren.