Bugzilla – Bug 1184177
VUL-0: CVE-2021-28957: python-lxml,python3-lxml:missing input sanitization for formaction HTML5 attributes may lead to XSS
Last modified: 2024-06-13 15:42:25 UTC
rh#1941534 lxml 4.6.2 allows XSS. It places the HTML action attribute into defs.link_attrs (in html/defs.py) for later use in input sanitization, but does not do the same for the HTML5 formaction attribute. Reference: https://bugs.launchpad.net/lxml/+bug/1888153 References: https://bugzilla.redhat.com/show_bug.cgi?id=1941534 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-28957 https://access.redhat.com/security/cve/CVE-2021-28957 http://www.debian.org/security/-1/dsa-4880 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28957 https://github.com/lxml/lxml/pull/316/commits/10ec1b4e9f93713513a3264ed6158af22492f270 https://bugs.launchpad.net/lxml/+bug/1888153 https://lists.debian.org/debian-lts-announce/2021/03/msg00031.html https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=985643
Any plans to fix this in SUSE:SLE-15-SP2:Update? Thank you.
Sorry for the delay. As the update was accepted, set this to resolved.
Hi Thomas, when dealing with security-related BZ issues, please do not close them yourself, instead re-assign them back to security-team@suse.de. This way we can double-check if the patch is successfully delivered on all affected products, then close the issue. (In reply to Thomas Schraitle from comment #4) > Sorry for the delay. As the update was accepted, set this to resolved. Your SR (Submission Request) SR#263873 [0] has been accepted within a maintenance incident, but it's not yet released to any product. A RR (Release Request) RR#264553 [1] has been created out of your SR and it's currently under QA. Only when the RR will be accepted then the update is released to the costumers. Moreover, there are more codestreams flagged as affected that requires a submission from you. Usually, this is our (security-team) job to inform the maintainer about which packages are affected. Unfortunately, who reported this issue forgot that step. Please submit to the following codestream: SUSE:SLE-11-SP3:Update/python-lxml 2.3.6 SUSE:SLE-11:Update/python-lxml 2.1.2 SUSE:SLE-12-SP2:Update/python-lxml 3.6.1 SUSE:SLE-15-SP2:Update/python-lxml 4.4.2 SUSE:SLE-15:Update/python-lxml 4.0.0 SUSE:SLE-12-SP4:Update/python3-lxml 3.6.1 SUSE:SLE-12:Update/python3-lxml 3.3.5 @cloud-team, please submit to the following one: SUSE:SLE-12-SP4:Update:Products:Cloud9:Update/python-lxml 4.2.4 Cheers, Gianluca [0] https://build.suse.de/request/show/263873 [1] https://build.suse.de/request/show/264553
Thanks Gianluca, much appreciated your information and sorry for the noise. I haven't forgot the other parts. One of my colleagues has left the company and I take over some of his tasks. But I'm looking into the list right now. :)
openSUSE-SU-2022:0803-1: An update that fixes four vulnerabilities is now available. Category: security (important) Bug References: 1118088,1179534,1184177,1193752 CVE References: CVE-2018-19787,CVE-2020-27783,CVE-2021-28957,CVE-2021-43818 JIRA References: Sources used: openSUSE Leap 15.4 (src): python-lxml-4.7.1-3.7.1 openSUSE Leap 15.3 (src): python-lxml-4.7.1-3.7.1
SUSE-SU-2022:0803-1: An update that fixes four vulnerabilities is now available. Category: security (important) Bug References: 1118088,1179534,1184177,1193752 CVE References: CVE-2018-19787,CVE-2020-27783,CVE-2021-28957,CVE-2021-43818 JIRA References: Sources used: SUSE Manager Server 4.1 (src): python-lxml-4.7.1-3.7.1 SUSE Manager Retail Branch Server 4.1 (src): python-lxml-4.7.1-3.7.1 SUSE Manager Proxy 4.1 (src): python-lxml-4.7.1-3.7.1 SUSE Linux Enterprise Server for SAP 15-SP2 (src): python-lxml-4.7.1-3.7.1 SUSE Linux Enterprise Server 15-SP2-LTSS (src): python-lxml-4.7.1-3.7.1 SUSE Linux Enterprise Server 15-SP2-BCL (src): python-lxml-4.7.1-3.7.1 SUSE Linux Enterprise Realtime Extension 15-SP2 (src): python-lxml-4.7.1-3.7.1 SUSE Linux Enterprise Module for Python2 15-SP3 (src): python-lxml-4.7.1-3.7.1 SUSE Linux Enterprise Module for Basesystem 15-SP4 (src): python-lxml-4.7.1-3.7.1 SUSE Linux Enterprise Module for Basesystem 15-SP3 (src): python-lxml-4.7.1-3.7.1 SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (src): python-lxml-4.7.1-3.7.1 SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (src): python-lxml-4.7.1-3.7.1 SUSE Enterprise Storage 7 (src): python-lxml-4.7.1-3.7.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2022:0895-1: An update that fixes four vulnerabilities is now available. Category: security (moderate) Bug References: 1118088,1179534,1184177,1193752 CVE References: CVE-2018-19787,CVE-2020-27783,CVE-2021-28957,CVE-2021-43818 JIRA References: Sources used: SUSE OpenStack Cloud Crowbar 8 (src): python-lxml-3.6.1-8.5.1 SUSE OpenStack Cloud 8 (src): python-lxml-3.6.1-8.5.1 SUSE Linux Enterprise Server 12-SP5 (src): python-lxml-3.6.1-8.5.1 HPE Helion Openstack 8 (src): python-lxml-3.6.1-8.5.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
https://build.opensuse.org/request/show/967839 accepted
SUSE-SU-2022:1536-1: An update that fixes 8 vulnerabilities is now available. Category: security (important) Bug References: 1118088,1184177,1196249,1196877,1197279,1197417,1197637,1198556 CVE References: CVE-2018-19787,CVE-2021-28957,CVE-2022-0778,CVE-2022-22934,CVE-2022-22935,CVE-2022-22936,CVE-2022-22941,CVE-2022-24302 JIRA References: Sources used: SUSE Manager Tools 12-BETA (src): venv-salt-minion-3004-3.9.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2022:1729-1: An update that solves 17 vulnerabilities, contains two features and has one errata is now available. Category: security (important) Bug References: 1118088,1179534,1184177,1186380,1189390,1189794,1192070,1192073,1192075,1193597,1193688,1193752,1194521,1194551,1194552,1194952,1194954,1199138 CVE References: CVE-2018-19787,CVE-2020-27783,CVE-2021-28957,CVE-2021-38155,CVE-2021-40085,CVE-2021-41182,CVE-2021-41183,CVE-2021-41184,CVE-2021-43813,CVE-2021-43818,CVE-2021-44716,CVE-2022-22815,CVE-2022-22816,CVE-2022-22817,CVE-2022-23451,CVE-2022-23452,CVE-2022-29970 JIRA References: SOC-11620,SOC-11621 Sources used: SUSE OpenStack Cloud Crowbar 9 (src): grafana-6.7.4-3.26.1, openstack-barbican-7.0.1~dev24-3.14.1, openstack-cinder-13.0.10~dev24-3.34.2, openstack-heat-gbp-14.0.1~dev4-3.9.1, openstack-horizon-plugin-gbp-ui-14.0.1~dev3-3.9.1, openstack-ironic-11.1.5~dev18-3.28.2, openstack-keystone-14.2.1~dev9-3.28.2, openstack-neutron-13.0.8~dev206-3.40.1, openstack-neutron-gbp-14.0.1~dev33-3.31.1, python-Pillow-5.2.0-3.17.1, python-XStatic-jquery-ui-1.13.0.1-4.3.1, python-lxml-4.2.4-3.3.1, release-notes-suse-openstack-cloud-9.20220413-3.30.1, rubygem-sinatra-1.4.6-4.3.1 SUSE OpenStack Cloud 9 (src): ardana-barbican-9.0+git.1644879908.8a641c1-3.13.1, grafana-6.7.4-3.26.1, openstack-barbican-7.0.1~dev24-3.14.1, openstack-cinder-13.0.10~dev24-3.34.2, openstack-heat-gbp-14.0.1~dev4-3.9.1, openstack-horizon-plugin-gbp-ui-14.0.1~dev3-3.9.1, openstack-ironic-11.1.5~dev18-3.28.2, openstack-keystone-14.2.1~dev9-3.28.2, openstack-neutron-13.0.8~dev206-3.40.1, openstack-neutron-gbp-14.0.1~dev33-3.31.1, python-Pillow-5.2.0-3.17.1, python-XStatic-jquery-ui-1.13.0.1-4.3.1, python-lxml-4.2.4-3.3.1, release-notes-suse-openstack-cloud-9.20220413-3.30.1, venv-openstack-barbican-7.0.1~dev24-3.35.2, venv-openstack-cinder-13.0.10~dev24-3.38.1, venv-openstack-designate-7.0.2~dev2-3.35.1, venv-openstack-glance-17.0.1~dev30-3.33.1, venv-openstack-heat-11.0.4~dev4-3.35.1, venv-openstack-horizon-14.1.1~dev11-4.39.1, venv-openstack-ironic-11.1.5~dev18-4.33.1, venv-openstack-keystone-14.2.1~dev9-3.36.1, venv-openstack-magnum-7.2.1~dev1-4.35.1, venv-openstack-manila-7.4.2~dev60-3.41.1, venv-openstack-monasca-2.7.1~dev10-3.37.1, venv-openstack-monasca-ceilometer-1.8.2~dev3-3.35.1, venv-openstack-neutron-13.0.8~dev206-6.39.1, venv-openstack-nova-18.3.1~dev91-3.39.1, venv-openstack-octavia-3.2.3~dev7-4.35.1, venv-openstack-sahara-9.0.2~dev15-3.35.1, venv-openstack-swift-2.19.2~dev48-2.30.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Hi Gayane, I saw from comment#18 you did the update (many thanks!). For some reasons, I'm still assigned to this bug. It seems, however, this bug is already fixed. Is my impression correct? Thank you!
(In reply to Thomas Schraitle from comment #21) > Hi Gayane, > I saw from comment#18 you did the update (many thanks!). > For some reasons, I'm still assigned to this bug. It seems, however, this > bug is already fixed. Is my impression correct? > > Thank you! Hi Thomas, Maintenance Updates released for Cloud9 . Regards, Gayane
same as bsc#1179534c10
SUSE-SU-2022:3836-1: An update that fixes two vulnerabilities is now available. Category: security (moderate) Bug References: 1179534,1184177 CVE References: CVE-2020-27783,CVE-2021-28957 JIRA References: Sources used: openSUSE Leap 15.3 (src): python-lxml-4.0.0-150000.4.3.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2022:3934-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 1184177 CVE References: CVE-2021-28957 JIRA References: Sources used: SUSE Linux Enterprise Module for Public Cloud 12 (src): python3-lxml-3.3.5-3.15.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2022:3937-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 1184177 CVE References: CVE-2021-28957 JIRA References: Sources used: SUSE Linux Enterprise Server 12-SP5 (src): python3-lxml-3.6.1-3.6.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.