Cross-site scripting in Lxml - CVE-2021-28957

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU51777

Cross-site scripting in Lxml - CVE-2021-28957

Published: March 30, 2021


Vulnerability identifier: #VU51777
CSH Severity: Low
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2021-28957
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.


Affected software

Lxml
Gentoo Linux
Fedora
Red Hat Enterprise Linux for Power, little endian
Red Hat CodeReady Linux Builder for IBM z Systems
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
HPE Helion Openstack
SUSE Manager Tools
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Public Cloud
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP Applications
Ubuntu
openSUSE Leap
openEuler
lxml (Debian package)
py3-lxml (Alpine package)
python-lxml (Ubuntu package)
python3-lxml (Ubuntu package)
python3-lxml-doc
python3-lxml
python3-lxml-debuginfo
python3-lxml-debugsource
python-lxml
python-lxml-debuginfo
python-lxml-debugsource
python2-lxml-doc
python-lxml (Red Hat package)
python2-lxml
python-lxml-help
dev-python/lxml
venv-salt-minion
IBM Qradar SIEM
Juniper Cloud Native Router
Junos cRPD

How to mitigate CVE-2021-28957

Install updates from vendor's website.

Lxml - update to 4.6.3
lxml (Debian package) - update to 4.3.2-1+deb10u3
py3-lxml (Alpine package) - update to 4.6.3-r0
IBM Qradar SIEM - update to 7.5.0 Update Pack 8
python-lxml (Ubuntu package) - addressed in versions 3.3.3-1ubuntu0.2+esm3, 3.5.0-1ubuntu0.4, 4.2.1-1ubuntu0.4, 4.5.0-1ubuntu0.3
python3-lxml (Ubuntu package) - addressed in versions 3.3.3-1ubuntu0.2+esm3, 3.5.0-1ubuntu0.4, 4.2.1-1ubuntu0.4, 4.5.0-1ubuntu0.3, 4.5.2-1ubuntu0.4
python3-lxml-doc - addressed in versions 3.3.5-3.15.1, 4.0.0-150000.4.3.1
python3-lxml - addressed in versions 3.3.5-3.15.1, 3.6.1-3.6.1
python3-lxml-debuginfo - update to 3.6.1-3.6.1
python3-lxml-debugsource - update to 3.6.1-3.6.1
python-lxml - update to 3.6.1-8.5.1
python-lxml-debuginfo - update to 3.6.1-8.5.1
python-lxml-debugsource - update to 3.6.1-8.5.1
python2-lxml-doc - update to 4.0.0-150000.4.3.1
python-lxml (Red Hat package) - update to 4.2.3-3.el8
python3-lxml - update to 4.2.5-4.el7
python-lxml - addressed in versions 4.5.1-4.fc33, 4.6.3-1.fc34, 4.6.3-1.fc35
python-lxml - update to 4.5.2-3
python-lxml-debugsource - update to 4.5.2-3
python2-lxml - update to 4.5.2-3
python-lxml-debuginfo - update to 4.5.2-3
python3-lxml - update to 4.5.2-3
python-lxml-help - update to 4.5.2-3
dev-python/lxml - update to 4.9.1
Juniper Cloud Native Router - update to 23.4R1
Junos cRPD - update to 23.4R1
venv-salt-minion - update to 3004-3.9.1

External References

Related Security Bulletins