An issue was discovered in markdown2 (aka python-markdown2) through 2.3.5. The safe_mode feature, which is supposed to sanitize user input against XSS, is flawed and does not escape the input properly. With a crafted payload, XSS can be triggered, as demonstrated by omitting the final '>' character from an IMG tag.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - An issue was discovered in markdown2 (aka python-markdown2) through 2.3.5. The safe_mode feature, which is
    supposed to sanitize user input against XSS, is flawed and does not escape the input properly. With a
    crafted payload, XSS can be triggered, as demonstrated by omitting the final '>' character from an IMG
    tag. (CVE-2018-5773)

## python-markdown2 2.3.7

  - [pull #306] Drop support for legacy Python versions

  - [pull #307] Fix syntax highlighting test cases that     depend on Pygments output

  - [pull #308] Add support for Python 3.7

  - [pull #304] Add Wheel package support

  - [pull #312] Fix toc_depth initialization regression

  - [pull #315] XSS fix

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

#### python-markdown2 2.3.6 ####

  - [pull #282] Add TOC depth option

  - [pull #283] Fix to add TOC html to output via CLI

  - [pull #284] Do not remove anchors in safe_mode

  - [pull #288] fixing cuddled-lists with a single list item

  - [pull #292] Fix Wrong rendering of last list element

  - [pull #295] link-patterns fix

  - [pull #300] Replace a deprecated method

  - [pull #301] DeprecationWarning: invalid escape sequence

  - [pull #302] Fix 'make test' in Python 3

  - [pull #303] Fix CVE-2018-5773

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
422586	SCA: security update for markdown2 (GHSA-p6h9-gw49-rqm4)	Tenable Cloud Security	SCA Checks	medium
422586	SCA: security update for markdown2 (GHSA-p6h9-gw49-rqm4)	Tenable Self-Hosted Container Security	SCA Checks	medium
122287	Fedora 28 : python-markdown2 (2019-a16e1127d3)	Nessus	Fedora Local Security Checks	medium
122274	Fedora 29 : python-markdown2 (2019-095c760511)	Nessus	Fedora Local Security Checks	medium
120847	Fedora 28 : python-markdown2 (2018-dd98177cad)	Nessus	Fedora Local Security Checks	medium
120497	Fedora 29 : python-markdown2 (2018-6a8028084d)	Nessus	Fedora Local Security Checks	medium
118048	Fedora 27 : python-markdown2 (2018-e52160d0bc)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2018-5773

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium