GHSA-55x5-fj6c-h6m8
lxml's HTML Cleaner allows crafted and SVG embedded scripts to pass through
At a glance
- Published
- Updated
- CVE
- CVE-2021-43818
- Aliases
- PYSEC-2021-852
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N
- CVSS_V4
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N
Description
### Impact The HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG files embedded using data URIs. Users that employ the HTML cleaner in a security relevant context should upgrade to lxml 4.6.5. ### Patches The issue has been resolved in lxml 4.6.5. ### Workarounds None. ### References The issues are tracked under the report IDs GHSL-2021-1037 and GHSL-2021-1038.
Affected packages
| Package | Versions |
|---|---|
| PyPI · lxml | introduced 0, fixed 4.6.5 |
References
- https://github.com/lxml/lxml/security/advisories/GHSA-55x5-fj6c-h6m8 WEB
- https://nvd.nist.gov/vuln/detail/CVE-2021-43818 ADVISORY
- https://github.com/lxml/lxml/commit/12fa9669007180a7bb87d990c375cf91ca5b664a WEB
- https://github.com/lxml/lxml/commit/a3eacbc0dcf1de1c822ec29fb7d090a4b1712a9c#diff-59130575b4fb2932c957db2922977d7d89afb0b2085357db1a14615a2fcad776 WEB
- https://github.com/lxml/lxml/commit/f2330237440df7e8f39c3ad1b1aa8852be3b27c0 WEB
- https://www.oracle.com/security-alerts/cpujul2022.html WEB
- https://www.oracle.com/security-alerts/cpuapr2022.html WEB
- https://www.debian.org/security/2022/dsa-5043 WEB
- https://security.netapp.com/advisory/ntap-20220107-0005 WEB
- https://security.gentoo.org/glsa/202208-06 WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZQ4SPKJX3RRJK4UWA6FXCRHD2TVRQI44 WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WZGNET2A4WGLSUXLBFYKNC5PXHQMI3I7 WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V2XMOM5PFT6U5AAXY6EFNT5JZCKKHK2V WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TUIS2KE3HZ2AAQKXFLTJFZPP2IFHJTC7 WEB
- https://lists.debian.org/debian-lts-announce/2021/12/msg00037.html WEB
- https://github.com/pypa/advisory-database/tree/main/vulns/lxml/PYSEC-2021-852.yaml WEB
- https://github.com/lxml/lxml PACKAGE
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |