CVE-2020-27783

NameCVE-2020-27783
DescriptionA XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behaviors between the sanitizer and the user's page. A remote attacker could exploit this flaw to run arbitrary HTML/JS code.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-2467-1, DSA-4810-1, ELA-332-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
lxml (PTS)jessie, jessie (lts)3.4.0-1+deb8u5fixed
stretch (security), stretch (lts), stretch3.7.1-1+deb9u5fixed
buster (security), buster, buster (lts)4.3.2-1+deb10u4fixed
bullseye (security), bullseye4.6.3+dfsg-0.1+deb11u1fixed
bookworm4.9.2-1fixed
sid, trixie5.3.0-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
lxmlsourcejessie3.4.0-1+deb8u3ELA-332-1
lxmlsourcestretch3.7.1-1+deb9u1DLA-2467-1
lxmlsourcebuster4.3.2-1+deb10u1DSA-4810-1
lxmlsource(unstable)4.6.2-1

Notes

https://github.com/lxml/lxml/commit/89e7aad6e7ff9ecd88678ff25f885988b184b26e (lxml-4.6.1)
https://github.com/lxml/lxml/commit/a105ab8dc262ec6735977c25c13f0bdfcdec72a7 (lxml-4.6.2)

Search for package or bug name: Reporting problems