1. Forum
  2. Usenet
  3. LINUX.DEBIAN.ANNOUNCE.SEC

  • [SECURITY] [DSA 4892-1] python-bleach security update

    From Salvatore Bonaccorso@21:1/5 to All on Sun Apr 18 16:50:01 2021
    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA512

    - ------------------------------------------------------------------------- Debian Security Advisory DSA-4892-1 security@debian.org https://www.debian.org/security/ Salvatore Bonaccorso
    April 18, 2021 https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package : python-bleach
    CVE ID : CVE-2021-23980
    Debian Bug : 986251

    It was reported that python-bleach, a whitelist-based HTML-sanitizing
    library, is prone to a mutation XSS vulnerability in bleach.clean when
    'svg' or 'math' are in the allowed tags, 'p' or 'br' are in allowed
    tags, 'style', 'title', 'noscript', 'script', 'textarea', 'noframes',
    'iframe', or 'xmp' are in allowed tags and 'strip_comments=False' is
    set.

    For the stable distribution (buster), this problem has been fixed in
    version 3.1.2-0+deb10u2.

    We recommend that you upgrade your python-bleach packages.

    For the detailed security status of python-bleach please refer to its
    security tracker page at: https://security-tracker.debian.org/tracker/python-bleach

    Further information about Debian Security Advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org
    -----BEGIN PGP SIGNATURE-----

    iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmB8RR9fFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2 NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND z0Q1aA/9EAqeE2rVQJqomu6n23fFF08W2g1uGl/VCJyDrFaTFT/Y2D+YZvYmPjYs m0a4YfiBgtnc0ZccXStYkXEtIK91p4caQVEYnnPfsRzGOYciRCDfUBpt7lqMg0K+ Ea2v93V4cIwwFHKPZ9/bbQrU89XrTT/3Ii1gEidKV88cWYYRDNaViW07lctcsh17 U76IxjLVZqiz3mNg1kOm/YY897D/3sQfNhqMmFBzaiGHyCX/+qaj7i4rzOREcyo3 z51DX6dHwZSZmsMpKfXSGqHtk3NGc12JE0aXj4nXf7Wah7lYrGuniBD1f3TbZFwj RJlWFqRoYXoZeZDpbDxaV5cqCOfJALWygPk7psQ2H1kYqhm7vqEhJakq5r0Z+7eJ Dwsqhws+tyVriWnfsVdJDe7GvaYoLAji1bswBi8tEkTBy8huCDQJf5zwsm9Jv+UB 2hpK9YYJEr11r27m2VV68zpt5VGLE/qFPrQ9947oMtv1EC/wx1D+WYiUOIRZ8ZmU zIgbLDF+tNoiHq1q48+TfnQAymkCE89gBA+/oR4EigLoQrWIqGsjNgc889eMLVVS YLGhChHNvLgUnIxzGHz558+FoiKxRdHSip3DG/3G40JADbowliSckRpDQGN7P1MW kMJpCc7i8nO7JcWc/0r78EmmKBXP79vsK6p39HF6ECZeBu5G1Lc=
    =gdY/
    -----END PGP SIGNATURE-----

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)