Cross-site scripting in Lxml - CVE-2021-43818

Vulnerability identifier: #VU59660

CSH Severity: Low

CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

CVE-ID: CVE-2021-43818

CWE-ID: CWE-79

Exploitation vector: Remote access

Exploit availability: No public exploit available

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data within the HTML Cleaner in lxml.html. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Lxml
Amazon Linux AMI
Gentoo Linux
Fedora
Anolis OS
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat CodeReady Linux Builder for IBM z Systems
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
HPE Helion Openstack
SUSE Linux Enterprise Server
Ubuntu
openEuler
Red Hat Software Collections
Cloud Pak for Security (CP4S)
IBM Qradar SIEM
python-lxml (Red Hat package)
lxml (Debian package)
python38-wcwidth
python39-wcwidth
python38-PyMySQL
python39-PyMySQL
python39-toml
python38-pluggy
python39-pluggy
python38-Cython
python39-Cython
python38-wheel-wheel
python38-wheel
python39-wheel-wheel
python39-wheel
python39-iniconfig
python38-markupsafe
python38-asn1crypto
python38-atomicwrites
python38-scipy
python39-scipy
python39-pysocks
python38-pysocks
python38-py
python39-py
python38-six
python38-cffi
python39-cffi
python39-six
python38-numpy-doc
python38-numpy-f2py
python38-numpy
python39-numpy-doc
python39-numpy
python39-numpy-f2py
python38-urllib3
python39-urllib3
python38-pyparsing
python39-pyparsing
python38-babel
python39-pybind11
python39-pybind11-devel
python38-cryptography
python38-psycopg2-tests
python38-psycopg2
python38-psycopg2-doc
python38-idna
python39-psycopg2
python39-psycopg2-tests
python39-psycopg2-doc
python39-idna
python38-jinja2
python38-pycparser
python39-pycparser
python38-requests
python39-requests
python39-chardet
python38-chardet
python-lxml
python39-cryptography
python-lxml-debuginfo
python-lxml-debugsource
python38-rpm-macros
python38-idle
python38-devel
python38-libs
python38-debug
python38
python38-tkinter
python38-test
rh-python38-python (Red Hat package)
python39-debug
python39
python39-rpm-macros
python39-tkinter
python39-test
python39-devel
python39-idle
python39-libs
python38-ply
python39-ply
python-lxml (Ubuntu package)
python3-lxml (Ubuntu package)
python3-lxml
python38-lxml
rh-python38-python-lxml (Red Hat package)
python2-lxml
python-lxml-help
python39-lxml
mingw-python-lxml
python38-pytest
python38-mod_wsgi
python39-mod_wsgi
dev-python/lxml
python39-pyyaml
python38-pyyaml
python38-psutil
python39-psutil
python39-pytest
python38-more-itertools
python39-more-itertools
python38-packaging
python38-attrs
rh-python38-python-pip (Red Hat package)
python38-pip
python38-pip-wheel
python39-pip-wheel
python39-pip
python39-attrs
python39-packaging
python38-setuptools-wheel
python38-setuptools
python39-setuptools
python39-setuptools-wheel
python38-pytz
Juniper Secure Analytics (JSA)
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
Red Hat OpenShift Container Platform

Install updates from vendor's website.

Lxml - update to 4.6.5
Cloud Pak for Security (CP4S) - update to 1.10.7.0
python-lxml (Red Hat package) - update to 4.2.3-4.el8
lxml (Debian package) - addressed in versions 4.3.2-1+deb10u4, 4.6.3+dfsg-0.1+deb11u1
Juniper Secure Analytics (JSA) - update to 7.5.0 UP8 IF03
IBM Qradar SIEM - update to 7.5.0 Update Pack 8
python38-wcwidth - update to 0.1.7-16
python39-wcwidth - update to 0.2.5-3
python38-PyMySQL - update to 0.10.1-1
python39-PyMySQL - update to 0.10.1-2
python39-toml - update to 0.10.1-5
python38-pluggy - update to 0.13.0-3
python39-pluggy - update to 0.13.1-3
python38-Cython - update to 0.29.14-4
python39-Cython - update to 0.29.21-5
python38-wheel-wheel - update to 0.33.6-6
python38-wheel - update to 0.33.6-6
python39-wheel-wheel - update to 0.35.1-4
python39-wheel - update to 0.35.1-4
python39-iniconfig - update to 1.1.1-2
python38-markupsafe - update to 1.1.1-6
python38-asn1crypto - update to 1.2.0-3
python38-atomicwrites - update to 1.3.0-8
python38-scipy - update to 1.3.1-4
python39-scipy - update to 1.5.4-3
python39-pysocks - update to 1.7.1-4
python38-pysocks - update to 1.7.1-4
python38-py - update to 1.8.0-8
python39-py - update to 1.10.0-1
python38-six - update to 1.12.0-10
python38-cffi - update to 1.13.2-3
python39-cffi - update to 1.14.3-2
python39-six - update to 1.15.0-3
python38-numpy-doc - update to 1.17.3-6
python38-numpy-f2py - update to 1.17.3-6
python38-numpy - update to 1.17.3-6
python39-numpy-doc - update to 1.19.4-3
python39-numpy - update to 1.19.4-3
python39-numpy-f2py - update to 1.19.4-3
python38-urllib3 - update to 1.25.7-5
python39-urllib3 - update to 1.25.10-4
python38-pyparsing - update to 2.4.5-3
python39-pyparsing - update to 2.4.7-5
python38-babel - update to 2.7.0-11
python39-pybind11 - update to 2.7.1-1
python39-pybind11-devel - update to 2.7.1-1
python38-cryptography - update to 2.8-3
python38-psycopg2-tests - update to 2.8.4-4
python38-psycopg2 - update to 2.8.4-4
python38-psycopg2-doc - update to 2.8.4-4
python38-idna - update to 2.8-6
python39-psycopg2 - update to 2.8.6-2.0.1
python39-psycopg2-tests - update to 2.8.6-2.0.1
python39-psycopg2-doc - update to 2.8.6-2.0.1
python39-idna - update to 2.10-3
python38-jinja2 - update to 2.10.3-5
python38-pycparser - update to 2.19-3
python39-pycparser - update to 2.20-3
python38-requests - update to 2.22.0-9
python39-requests - update to 2.25.0-2
python39-chardet - update to 3.0.4-19
python38-chardet - update to 3.0.4-19
python-lxml - addressed in versions 3.2.1-4.10, 4.7.1-3
python39-cryptography - update to 3.3.1-2
python-lxml-debuginfo - update to 3.6.1-8.5.1
python-lxml-debugsource - update to 3.6.1-8.5.1
python-lxml - update to 3.6.1-8.5.1
python38-rpm-macros - update to 3.8.12-1.0.1
python38-idle - update to 3.8.12-1.0.1
python38-devel - update to 3.8.12-1.0.1
python38-libs - update to 3.8.12-1.0.1
python38-debug - update to 3.8.12-1.0.1
python38 - update to 3.8.12-1.0.1
python38-tkinter - update to 3.8.12-1.0.1
python38-test - update to 3.8.12-1.0.1
rh-python38-python (Red Hat package) - update to 3.8.13-1.el7
python39-debug - update to 3.9.7-1.0.1
python39 - update to 3.9.7-1.0.1
python39-rpm-macros - update to 3.9.7-1.0.1
python39-tkinter - update to 3.9.7-1.0.1
python39-test - update to 3.9.7-1.0.1
python39-devel - update to 3.9.7-1.0.1
python39-idle - update to 3.9.7-1.0.1
python39-libs - update to 3.9.7-1.0.1
python38-ply - update to 3.11-10
python39-ply - update to 3.11-10
python-lxml (Ubuntu package) - addressed in versions 4.2.1-1ubuntu0.6, 4.5.0-1ubuntu0.5
python3-lxml (Ubuntu package) - addressed in versions 4.2.1-1ubuntu0.6, 4.5.0-1ubuntu0.5, 4.6.3+dfsg-0.1ubuntu0.2, 4.6.3-1ubuntu0.2
python3-lxml - update to 4.2.3-4
python3-lxml - update to 4.2.5-5.el7
python38-lxml - update to 4.4.1-7
rh-python38-python-lxml (Red Hat package) - update to 4.4.1-8.el7
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.5.1
python-lxml-debugsource - update to 4.5.2-4
python3-lxml - update to 4.5.2-4
python-lxml-debuginfo - update to 4.5.2-4
python-lxml - update to 4.5.2-4
python2-lxml - update to 4.5.2-4
python-lxml-help - update to 4.5.2-4
python39-lxml - update to 4.6.5-1
python-lxml - addressed in versions 4.6.5-1.fc34, 4.6.5-1.fc35
mingw-python-lxml - addressed in versions 4.6.5-1.fc34, 4.6.5-1.fc35
python38-pytest - update to 4.6.6-3
python38-mod_wsgi - update to 4.6.8-3
python39-mod_wsgi - update to 4.7.1-4
dev-python/lxml - update to 4.9.1
Red Hat OpenShift Container Platform - update to 4.11.0
python39-pyyaml - update to 5.4.1-1
python38-pyyaml - update to 5.4.1-1
python38-psutil - update to 5.6.4-4
python39-psutil - update to 5.8.0-4.0.1
python39-pytest - update to 6.0.2-2
python38-more-itertools - update to 7.2.0-5
python39-more-itertools - update to 8.5.0-2
python38-packaging - update to 19.2-3
python38-attrs - update to 19.3.0-3
rh-python38-python-pip (Red Hat package) - update to 19.3.1-3.el7
python38-pip - update to 19.3.1-5
python38-pip-wheel - update to 19.3.1-5
python39-pip-wheel - update to 20.2.4-7
python39-pip - update to 20.2.4-7
python39-attrs - update to 20.3.0-2
python39-packaging - update to 20.4-4
python38-setuptools-wheel - update to 41.6.0-5
python38-setuptools - update to 41.6.0-5
python39-setuptools - update to 50.3.2-4
python39-setuptools-wheel - update to 50.3.2-4
python38-pytz - update to 2019.3-3

• https://github.com/lxml/lxml/commit/f2330237440df7e8f39c3ad1b1aa8852be3b27c0
• https://github.com/lxml/lxml/commit/a3eacbc0dcf1de1c822ec29fb7d090a4b1712a9c#diff-59130575b4fb2932c957db2922977d7d89afb0b2085357db1a14615a2fcad776
• https://github.com/lxml/lxml/security/advisories/GHSA-55x5-fj6c-h6m8
• https://github.com/lxml/lxml/commit/12fa9669007180a7bb87d990c375cf91ca5b664a
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WZGNET2A4WGLSUXLBFYKNC5PXHQMI3I7/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZQ4SPKJX3RRJK4UWA6FXCRHD2TVRQI44/
• https://lists.debian.org/debian-lts-announce/2021/12/msg00037.html
• https://security.netapp.com/advisory/ntap-20220107-0005/
• https://www.debian.org/security/2022/dsa-5043
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TUIS2KE3HZ2AAQKXFLTJFZPP2IFHJTC7/

• Cross-site scripting in Lxml
• Debian update for lxml
• Red Hat Software Collections update for python-lxml
• Red Hat Enterprise Linux 8 update for the python39:3.9 and python39-devel:3.9 modules
• Red Hat Enterprise Linux 8 update for the python38:3.8 and python38-devel:3.8 modules
• Red Hat Enterprise Linux 8 update for the python27:2.7 module
• Red Hat Enterprise Linux 8 update for python-lxml
• Ubuntu update for lxml
• Gentoo update for lxml
• Multiple vulnerabilities in OpenShift Container Platform 4.11
• Multiple vulnerabilities in IBM Cloud Pak for Security (CP4S)
• Cross-site scripting in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
• SUSE update for python-lxml
• Amazon Linux AMI update for python-lxml
• openEuler update for python-lxml
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in Juniper Secure Analytics (JSA)
• Amazon Linux AMI update for python-lxml
• Fedora 34 update for mingw-python-lxml
• Fedora 35 update for mingw-python-lxml
• Fedora 35 update for python-lxml
• Fedora 34 update for python-lxml
• Fedora EPEL 7 update for python3-lxml
• Anolis OS update for python-lxml
• Anolis OS update for python38:3.8 module
• Anolis OS update for python39:3.9 module