CVE-2021-28957

NameCVE-2021-28957
DescriptionAn XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS code on users who interact with incorrectly sanitized HTML. This issue is patched in lxml 4.6.3.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-2606-1, DSA-4880-1
NVD severitymedium
Debian Bugs985643

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
lxml (PTS)stretch3.7.1-1vulnerable
stretch (security)3.7.1-1+deb9u4fixed
buster4.3.2-1+deb10u2vulnerable
buster (security)4.3.2-1+deb10u3fixed
bullseye, sid4.6.3-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
lxmlsourcestretch3.7.1-1+deb9u4DLA-2606-1
lxmlsourcebuster4.3.2-1+deb10u3DSA-4880-1
lxmlsource(unstable)4.6.3-1985643

Notes

https://bugs.launchpad.net/lxml/+bug/1888153
https://github.com/lxml/lxml/pull/316
https://github.com/lxml/lxml/commit/2d01a1ba8984e0483ce6619b972832377f208a0d

Search for package or bug name: Reporting problems