lxml_html_clean is a project for HTML cleaning functionalities copied from `lxml.html.clean`. Prior to version 0.4.0, the HTML Parser in lxml does not properly handle context-switching for special HTML tags such as `<svg>`, `<math>` and `<noscript>`. This behavior deviates from how web browsers parse and interpret such tags. Specifically, content in CSS comments is ignored by lxml_html_clean but may be interpreted differently by web browsers, enabling malicious scripts to bypass the cleaning process. This vulnerability could lead to Cross-Site Scripting (XSS) attacks, compromising the security of users relying on lxml_html_clean in default configuration for sanitizing untrusted HTML content. Users employing the HTML cleaner in a security-sensitive context should upgrade to lxml 0.4.0, which addresses this issue. As a temporary mitigation, users can configure lxml_html_clean with the following settings to prevent the exploitation of this vulnerability. Via `remove_tags`, one may specify tags to remove - their content is moved to their parents' tags. Via `kill_tags`, one may specify tags to be removed completely. Via `allow_tags`, one may restrict the set of permissible tags, excluding context-switching tags like `<svg>`, `<math>` and `<noscript>`.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - lxml_html_clean is a project for HTML cleaning functionalities copied from `lxml.html.clean`. Prior to     version 0.4.0, the HTML Parser in lxml does not properly handle context-switching for special HTML tags     such as `<svg>`, `<math>` and `<noscript>`. This behavior deviates from how web browsers parse and     interpret such tags. Specifically, content in CSS comments is ignored by lxml_html_clean but may be     interpreted differently by web browsers, enabling malicious scripts to bypass the cleaning process. This     vulnerability could lead to Cross-Site Scripting (XSS) attacks, compromising the security of users relying     on lxml_html_clean in default configuration for sanitizing untrusted HTML content. Users employing the     HTML cleaner in a security-sensitive context should upgrade to lxml 0.4.0, which addresses this issue. As     a temporary mitigation, users can configure lxml_html_clean with the following settings to prevent the     exploitation of this vulnerability. Via `remove_tags`, one may specify tags to remove - their content is     moved to their parents' tags. Via `kill_tags`, one may specify tags to be removed completely. Via     `allow_tags`, one may restrict the set of permissible tags, excluding context-switching tags like `<svg>`,     `<math>` and `<noscript>`. (CVE-2024-52595)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - lxml_html_clean is a project for HTML cleaning functionalities copied from `lxml.html.clean`. Prior to
    version 0.4.0, the HTML Parser in lxml does not properly handle context-switching for special HTML tags
    such as `<svg>`, `<math>` and `<noscript>`. This behavior deviates from how web browsers parse and
    interpret such tags. Specifically, content in CSS comments is ignored by lxml_html_clean but may be
    interpreted differently by web browsers, enabling malicious scripts to bypass the cleaning process. This
    vulnerability could lead to Cross-Site Scripting (XSS) attacks, compromising the security of users relying
    on lxml_html_clean in default configuration for sanitizing untrusted HTML content. Users employing the
    HTML cleaner in a security-sensitive context should upgrade to lxml 0.4.0, which addresses this issue. As
    a temporary mitigation, users can configure lxml_html_clean with the following settings to prevent the
    exploitation of this vulnerability. Via `remove_tags`, one may specify tags to remove - their content is
    moved to their parents' tags. Via `kill_tags`, one may specify tags to be removed completely. Via
    `allow_tags`, one may restrict the set of permissible tags, excluding context-switching tags like `<svg>`,
    `<math>` and `<noscript>`. (CVE-2024-52595)

ID	Name	Product	Family	Type	Severity
256762	Linux Distros Unpatched Vulnerability : CVE-2024-52595	Nessus	Misc.	Local	medium
410889	SCA: security update for lxml-html-clean (GHSA-5jfw-gq64-q45f)	Tenable Cloud Security	SCA Checks	Local	medium
410889	SCA: security update for lxml-html-clean (GHSA-5jfw-gq64-q45f)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2024-52595

medium

Tenable Plugins

medium

medium

medium