This update fixes mXSS security vulnerability due to the use of improper parser (CVE-2020-27783)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the python-lxml packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A XSS vulnerability was discovered in python-lxml's     clean module. The module's parser didn't properly     imitate browsers, which caused different behaviors     between the sanitizer and the user's page. A remote     attacker could exploit this flaw to run arbitrary     HTML/JS code.(CVE-2020-27783)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2021:1898 advisory.

    lxml is an XML processing library providing access to libxml2 and libxslt libraries using the Python     ElementTree API.

    Security Fix(es):

    * python-lxml: mXSS due to the use of improper parser (CVE-2020-27783)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.4 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the python-lxml package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A XSS vulnerability was discovered in python-lxml's     clean module. The module's parser didn't properly     imitate browsers, which caused different behaviors     between the sanitizer and the user's page. A remote     attacker could exploit this flaw to run arbitrary     HTML/JS code.(CVE-2020-27783)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the python-lxml package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in lxml before 4.2.5.
    lxml/html/clean.py in the lxml.html.clean module does     not remove javascript: URLs that use escaping, allowing     a remote attacker to conduct XSS attacks, as     demonstrated by 'j a v a s c r i p t:' in Internet     Explorer. This is a similar issue to     CVE-2014-3146.(CVE-2018-19787)

  - A XSS vulnerability was discovered in python-lxml's     clean module. The module's parser didn't properly     imitate browsers, which caused different behaviors     between the sanitizer and the user's page. A remote     attacker could exploit this flaw to run arbitrary     HTML/JS code.CVE-2020-27783)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3836-1 advisory.

  - A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly     imitate browsers, which caused different behaviors between the sanitizer and the user's page. A remote     attacker could exploit this flaw to run arbitrary HTML/JS code. (CVE-2020-27783)

  - An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling     the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribute     allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS     code on users who interact with incorrectly sanitized HTML. This issue is patched in lxml 4.6.3.
    (CVE-2021-28957)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:1879 advisory.

  - python: CRLF injection via HTTP request method in httplib/http.client (CVE-2020-26116)

  - python-lxml: mXSS due to the use of improper parser (CVE-2020-27783)

  - python: Stack-based buffer overflow in PyCArg_repr in _ctypes/callproc.c (CVE-2021-3177)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-1879 advisory.

    - Security fix for CVE-2021-3177     Resolves: rhbz#1919161
    - Security fix for CVE-2020-26116

    python-requests

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
144957	Fedora 32 : python-lxml (2020-307946cfb6)	Nessus	Fedora Local Security Checks	1/14/2021	1/30/2024	medium
144963	Fedora 33 : python-lxml (2020-0e055ea503)	Nessus	Fedora Local Security Checks	1/14/2021	1/30/2024	medium
145738	EulerOS 2.0 SP8 : python-lxml (EulerOS-SA-2021-1166)	Nessus	Huawei Local Security Checks	2/1/2021	1/25/2024	medium
149665	RHEL 8 : python-lxml (RHSA-2021:1898)	Nessus	Red Hat Local Security Checks	5/19/2021	11/7/2024	critical
153334	EulerOS 2.0 SP2 : python-lxml (EulerOS-SA-2021-2431)	Nessus	Huawei Local Security Checks	9/14/2021	11/30/2023	medium
147095	EulerOS Virtualization for ARM 64 3.0.6.0 : python-lxml (EulerOS-SA-2021-1538)	Nessus	Huawei Local Security Checks	3/4/2021	1/16/2024	medium
170219	openSUSE 15 Security Update : python-lxml (SUSE-SU-2022:3836-1)	Nessus	SuSE Local Security Checks	1/20/2023	9/7/2023	medium
150032	CentOS 8 : python38:3.8 (CESA-2021:1879)	Nessus	CentOS Local Security Checks	5/28/2021	12/28/2023	critical
155324	Oracle Linux 8 : python38:3.8 (ELSA-2021-1879)	Nessus	Oracle Linux Local Security Checks	11/12/2021	11/1/2024	critical

Detections

Analytics

Plugins Search

medium

medium

medium

critical

medium

medium

medium

critical

critical