Bug 714596 (CVE-2020-6802, CVE-2020-6816) – <dev-python/bleach-3.1.3: Multiple vulnerabilities (CVE-2020-{6816,6802})

• Product: Gentoo Security
• Status: RESOLVED FIXED

[Description Sam James 2020-03-24 23:03:23 UTC]

1) CVE-2020-6816

Description:
"In Mozilla Bleach before 3.12, a mutation XSS in bleach.clean when RCDATA and either svg or math tags are whitelisted and the keyword argument strip=False."

URL: https://github.com/mozilla/bleach/security/advisories/GHSA-m6xf-fq7q-8743

2) CVE-2020-6802

Description:
"In Mozilla Bleach before 3.11, a mutation XSS affects users calling bleach.clean with noscript and a raw tag in the allowed/whitelisted tags option."

URL: https://github.com/mozilla/bleach/security/advisories/GHSA-q65m-pv3f-wr5r

[Comment 1 Sam James 2020-03-24 23:04:47 UTC]

@maintainer(s), please advise if you are ready for stabilisation, or call yourself.

[Comment 2 Agostino Sarubbo 2020-03-26 14:12:56 UTC]

ppc stable

[Comment 3 Agostino Sarubbo 2020-03-26 14:13:33 UTC]

ppc64 stable

[Comment 4 Agostino Sarubbo 2020-03-26 14:14:07 UTC]

s390 stable

[Comment 5 Agostino Sarubbo 2020-03-26 14:14:41 UTC]

sparc stable

[Comment 6 Agostino Sarubbo 2020-03-26 14:15:24 UTC]

x86 stable

[Comment 7 Agostino Sarubbo 2020-03-27 13:29:26 UTC]

amd64 stable

[Comment 8 Mart Raudsepp 2020-03-28 22:48:07 UTC]

arm64 stable

[Comment 9 Mart Raudsepp 2020-03-28 22:50:36 UTC]

arm/hppa/ia64 ALLARCHES stable

[Comment 10 Sam James 2020-03-30 19:44:59 UTC]

Cleanup was done by zlogene in:
https://bugs.gentoo.org/715058#c8

noglsa because XSS bug. Closing.