Alerts This Week
Warning Icon 1 1,149
Alerts This Week
Warning Icon 1 1,149

Debian 11 Bullseye DLA-3856-1 Critical: HTML Sanitization Bypass Fix

debian lts
Calendar Grey August 26, 2024
Dist Debian Esm H88
Safeguard your environment utilizing the Debian LTS Advisory DLA-3857-1, which focuses on remediating a security loophole in python-sanitizer-html.
It was discovered that there was a sanitisation bypass issue in python-html-sanitizer, a library used ensure that user-specified content cannot inject HTML or JavaScript into a web...
Topics%20covered

Topics Covered

security advisory Debian python web threat sanitisation bypass

Summary

If the default "keep_typographic_whitespace=False" value was set,
malicous users could have exploited the fact that some Unicode
characters normalise to chevrons, which allowed specially-crafted
HTML to escape sanitization.

For Debian 11 bullseye, this problem has been fixed in version
1.9.1-2+deb11u1.

We recommend that you upgrade your python-html-sanitizer packages.

For the detailed security status of python-html-sanitizer please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/source-package/python-html-sanitizer

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS



Severity
critical
Lowest
Low
Medium
High
Critical

Package: python-html-sanitizer
Version: 1.9.1-2+deb11u1
CVE ID: CVE-2024-34078
Debian Bug: 1070710

Topics%20covered

Topics Covered

security advisory Debian python web threat sanitisation bypass

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here