Cross-site scripting in Lxml - CVE-2018-19787

Vulnerability identifier: #VU16583

CSH Severity: Low

CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

CVE-ID: CVE-2018-19787

CWE-ID: CWE-79

Exploitation vector: Remote access

Exploit availability: No public exploit available

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to lxml/html/clean.py in the lxml.html.clean module does not remove javascript. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Lxml
Juniper Secure Analytics (JSA)
HPE Helion Openstack
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
SUSE Manager Tools
SUSE Linux Enterprise Server
Fedora
python-lxml
python-lxml-debuginfo
python-lxml-debugsource
venv-salt-minion
IBM Qradar SIEM

Update to version 4.2.5.

Lxml - update to 4.2.5
Juniper Secure Analytics (JSA) - update to 7.5.0 UP8 IF03
python-lxml - update to 3.6.1-8.5.1
python-lxml-debuginfo - update to 3.6.1-8.5.1
python-lxml-debugsource - update to 3.6.1-8.5.1
python-lxml - addressed in versions 4.2.5-1.fc28, 4.2.5-1.fc29
IBM Qradar SIEM - update to 7.5.0 Update Pack 8 IF02
venv-salt-minion - update to 3004-3.9.1

• https://github.com/lxml/lxml/commit/6be1d081b49c97cfd7b3fbd934a193b668629109

• Cross-site scripting in Lxml
• SUSE update for python-lxml
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in Juniper Secure Analytics (JSA)
• SUSE update for Security Beta update for SUSE Manager Salt Bundle
• Fedora 28 update for python-lxml
• Fedora 29 update for python-lxml