Stay Secure with the Latest Linux Advisories

security advisoryDebianpython

Debian 11 Bullseye DLA-3856-1 Critical: HTML Sanitization Bypass Fix

It was discovered that there was a sanitisation bypass issue in python-html-sanitizer, a library used ensure that user-specified content cannot inject HTML or JavaScript into a webpage. . - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3856-1 This email address is being protected from spambots. You need JavaScript enabled to view it. https://www.debian.org/lts/security/ Chris Lamb August 26, 2024 https://wiki.debian.org/LTS - ------------------------------------------------------------------------- Package : python-html-sanitizer Version : 1.9.1-2+deb11u1 CVE ID : CVE-2024-34078 Debian Bug : 1070710 It was discovered that there was a sanitisation bypass issue in python-html-sanitizer, a library used ensure that user-specified content cannot inject HTML or JavaScript into a webpage. If the default "keep_typographic_whitespace=False" value was set, malicous users could have exploited the fact that some Unicode characters normalise to chevrons, which allowed specially-crafted HTML to escape sanitization. For Debian 11 bullseye, this problem has been fixed in version 1.9.1-2+deb11u1. We recommend that you upgrade your python-html-sanitizer packages. For the detailed security status of python-html-sanitizer please refer to its security tracker page at: https://security-tracker.debian.org/tracker/source-package/python-html-sanitizer Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS . Safeguard your environment utilizing the Debian LTS Advisory DLA-3857-1, which focuses on remediating a security loophole in python-sanitizer-html.. Debian Security Update, Python Library Issue, Web Threat Mitigation. . Severity: Critical. LinuxSecurity.com Team

Aug 26, 2024 •Critical Debian LTS