MGASA-2020-0176 - Updated python-bleach packages fix security vulnerability

Publication date: 20 Apr 2020
URL: https://advisories.mageia.org/MGASA-2020-0176.html
Type: security
Affected Mageia releases: 7
CVE: CVE-2020-6816,
     CVE-2020-6817

In Mozilla Bleach before 3.12, a mutation XSS in bleach.clean when RCDATA
and either svg or math tags are whitelisted and the keyword argument
strip=False. (CVE-2020-6816)

Regular expression denial of service. (CVE-2020-6817)

References:
- https://bugs.mageia.org/show_bug.cgi?id=26445
- https://www.debian.org/security/2020/dsa-4643
- https://www.debian.org/lts/security/2020/dla-2167
- https://bugs.mageia.org/show_bug.cgi?id=26379
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6816
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6817

SRPMS:
- 7/core/python-bleach-3.1.4-1.mga7