CVE-2020-27783

NameCVE-2020-27783
DescriptionA XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behaviors between the sanitizer and the user's page. A remote attacker could exploit this flaw to run arbitrary HTML/JS code.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
ReferencesDLA-2467-1, DSA-4810-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
lxml (PTS)buster, buster (security)4.3.2-1+deb10u4fixed
bullseye (security), bullseye4.6.3+dfsg-0.1+deb11u1fixed
bookworm, sid4.9.2-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
lxmlsourcestretch3.7.1-1+deb9u1DLA-2467-1
lxmlsourcebuster4.3.2-1+deb10u1DSA-4810-1
lxmlsource(unstable)4.6.2-1

Notes

https://github.com/lxml/lxml/commit/89e7aad6e7ff9ecd88678ff25f885988b184b26e (lxml-4.6.1)
https://github.com/lxml/lxml/commit/a105ab8dc262ec6735977c25c13f0bdfcdec72a7 (lxml-4.6.2)
Search for package or bug name: Reporting problems