Alerts This Week
Warning Icon 1 640
Alerts This Week
Warning Icon 1 640

Mageia: 2021-0246 Moderate: Python-lxml XSS Risk from Remote Exploit

mageia
Calendar Grey June 13, 2021
Dist Mageia Esm H88
The recent patch in python-lxml addresses a critical XSS flaw, which poses significant security threats for various Mageia versions due to potential remote exploitation.
An XSS vulnerability was discovered in python-lxml’s clean module versions before 4.6.3

Summary

An XSS vulnerability was discovered in python-lxml’s clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS code on users who interact with incorrectly sanitized HTML (CVE-2021-28957).

References

- https://bugs.mageia.org/show_bug.cgi?id=28983

- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/3C2R44VDUY7FJVMAVRZ2WY7XYL4SVN45/

- https://lists.debian.org/debian-security-announce/2021/msg00061.html

- https://ubuntu.com/security/notices/USN-4896-1

- https://www.cve.org/CVERecord?id=CVE-2021-28957

Topics%20covered

Topics Covered

security advisory remote exploit moderate severity XSS issue Mageia python-lxml JS bypass

Resolution

SRPMS

- 8/core/python-lxml-4.6.3-1.mga8

- 7/core/python-lxml-4.3.0-1.3.mga7

Publication date: 13 Jun 2021
URL: https://advisories.mageia.org/MGASA-2021-0246.html
Type: security
CVE: CVE-2021-28957

Topics%20covered

Topics Covered

security advisory remote exploit moderate severity XSS issue Mageia python-lxml JS bypass

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here