CVE-2018-7753

Name	CVE-2018-7753
Description	An issue was discovered in Bleach 2.1.x before 2.1.3. Attributes that have URI values weren't properly sanitized if the values contained character entities. Using character entities, it was possible to construct a URI value with a scheme that was not allowed that would slide through unsanitized.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	892252

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
python-bleach (PTS)	bullseye	3.2.1-2.1	fixed
	bookworm	5.0.1-2	fixed
	forky, sid, trixie	6.2.0-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Debian Bugs
python-bleach	source	jessie	(not affected)
python-bleach	source	stretch	(not affected)
python-bleach	source	(unstable)	2.1.3-1	892252

Notes

[stretch] - python-bleach <not-affected> (Vulnerable code introduced later)
[jessie] - python-bleach <not-affected> (Vulnerable code introduced later)
https://github.com/mozilla/bleach/pull/356
https://github.com/mozilla/bleach/commit/c5df5789ec3471a31311f42c2d19fc2cf21b35ef