https://advisory.checkmarx.net/advisory/CX-2020-4286

https://bugzilla.redhat.com/show_bug.cgi?id=1901633

[debian-lts-announce] 20201218 [SECURITY] [DLA 2467-2] lxml regression update

FEDORA-2020-307946cfb6

FEDORA-2020-0e055ea503

DSA-4810

According to the version of the python-lxml package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A XSS vulnerability was discovered in python-lxml's     clean module. The module's parser didn't properly     imitate browsers, which caused different behaviors     between the sanitizer and the user's page. A remote     attacker could exploit this flaw to run arbitrary     HTML/JS code.(CVE-2020-27783)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the python-lxml package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - A XSS vulnerability was discovered in python-lxml's     clean module. The module's parser didn't properly     imitate browsers, which caused different behaviors     between the sanitizer and the user's page. A remote     attacker could exploit this flaw to run arbitrary     HTML/JS code.(CVE-2020-27783)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the python-lxml package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - A XSS vulnerability was discovered in python-lxml's     clean module. The module's parser didn't properly     imitate browsers, which caused different behaviors     between the sanitizer and the user's page. A remote     attacker could exploit this flaw to run arbitrary     HTML/JS code.(CVE-2020-27783)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the python-lxml package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in lxml before 4.2.5.
    lxml/html/clean.py in the lxml.html.clean module does     not remove javascript: URLs that use escaping, allowing     a remote attacker to conduct XSS attacks, as     demonstrated by 'j a v a s c r i p t:' in Internet     Explorer. This is a similar issue to     CVE-2014-3146.(CVE-2018-19787)

  - A XSS vulnerability was discovered in python-lxml's     clean module. The module's parser didn't properly     imitate browsers, which caused different behaviors     between the sanitizer and the user's page. A remote     attacker could exploit this flaw to run arbitrary     HTML/JS code.CVE-2020-27783)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the python-lxml package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A XSS vulnerability was discovered in python-lxml's     clean module. The module's parser didn't properly     imitate browsers, which caused different behaviors     between the sanitizer and the user's page. A remote     attacker could exploit this flaw to run arbitrary     HTML/JS code.(CVE-2020-27783)

  - Incomplete blacklist vulnerability in the     lxml.html.clean module in lxml before 3.3.5 allows     remote attackers to conduct cross-site scripting (XSS)     attacks via control characters in the link scheme to     the clean_html function.(CVE-2014-3146)

  - An issue was discovered in lxml before 4.2.5.
    lxml/html/clean.py in the lxml.html.clean module does     not remove javascript: URLs that use escaping, allowing     a remote attacker to conduct XSS attacks, as     demonstrated by 'j a v a s c r i p t:' in Internet     Explorer. This is a similar issue to     CVE-2014-3146.(CVE-2018-19787)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the python-lxml packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A XSS vulnerability was discovered in python-lxml's     clean module. The module's parser didn't properly     imitate browsers, which caused different behaviors     between the sanitizer and the user's page. A remote     attacker could exploit this flaw to run arbitrary     HTML/JS code.(CVE-2020-27783)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes mXSS security vulnerability due to the use of improper parser (CVE-2020-27783)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Yaniv Nizry discovered that the clean module of lxml, Python bindings for libxml2 and libxslt could be bypassed.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 20.10 host has packages installed that are affected by a vulnerability as referenced in the USN-4666-2 advisory.

  - A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly     imitate browsers, which caused different behaviors between the sanitizer and the user's page. A remote     attacker could exploit this flaw to run arbitrary HTML/JS code. (CVE-2020-27783)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 20.10 host has packages installed that are affected by a vulnerability as referenced in the USN-4666-1 advisory.

  - A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly     imitate browsers, which caused different behaviors between the sanitizer and the user's page. A remote     attacker could exploit this flaw to run arbitrary HTML/JS code. (CVE-2020-27783)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The fix for CVE-2020-27783, released as DLA 2467-1, was incomplete as the <math/svg> component was still affected by the vulnerability. This update includes an additional patch that completes the fix. Note that a package with version 3.7.1-1+deb9u2 was uploaded, but before the publication of the advisory a regression was discovered, which was immediately corrected prior to publication of this advisory.

For Debian 9 stretch, this problem has been fixed in version 3.7.1-1+deb9u3.

We recommend that you upgrade your lxml packages.

For the detailed security status of lxml please refer to its security tracker page at: https://security-tracker.debian.org/tracker/lxml

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
148061	EulerOS 2.0 SP5 : python-lxml (EulerOS-SA-2021-1701)	Nessus	Huawei Local Security Checks	medium
147527	EulerOS Virtualization 3.0.2.6 : python-lxml (EulerOS-SA-2021-1420)	Nessus	Huawei Local Security Checks	medium
147453	EulerOS Virtualization for ARM 64 3.0.2.0 : python-lxml (EulerOS-SA-2021-1402)	Nessus	Huawei Local Security Checks	medium
147095	EulerOS Virtualization for ARM 64 3.0.6.0 : python-lxml (EulerOS-SA-2021-1538)	Nessus	Huawei Local Security Checks	medium
147041	EulerOS Virtualization 3.0.6.6 : python-lxml (EulerOS-SA-2021-1514)	Nessus	Huawei Local Security Checks	medium
145738	EulerOS 2.0 SP8 : python-lxml (EulerOS-SA-2021-1166)	Nessus	Huawei Local Security Checks	medium
144963	Fedora 33 : python-lxml (2020-0e055ea503)	Nessus	Fedora Local Security Checks	medium
144957	Fedora 32 : python-lxml (2020-307946cfb6)	Nessus	Fedora Local Security Checks	medium
144702	EulerOS 2.0 SP9 : python-lxml (EulerOS-SA-2021-1035)	Nessus	Huawei Local Security Checks	medium
144676	EulerOS : python-lxml (EulerOS-SA-2021-1016)	Nessus	Huawei Local Security Checks	medium
144189	Debian DSA-4810-1 : lxml - security update	Nessus	Debian Local Security Checks	medium
144078	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 20.10 : lxml vulnerability (USN-4666-2)	Nessus	Ubuntu Local Security Checks	medium
144012	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 20.10 : lxml vulnerability (USN-4666-1)	Nessus	Ubuntu Local Security Checks	medium
143308	Debian DLA-2467-2 : lxml regression update	Nessus	Debian Local Security Checks	medium

CVE-2020-27783

MEDIUM

Description

References

Details

Risk Information

CVSS v2.0

CVSS v3.0

Vulnerable Software

Configuration 1

Configuration 2

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium