Bug 777579 – <dev-python/lxml-4.6.3: JavaScript passthrough in HTML cleaner (CVE-2021-28957)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Michał Górny 2021-03-21 19:51:45 UTC]

+4.6.3 (2021-03-21)
+==================
+
+Bugs fixed
+----------
+
+* A vulnerability (CVE-2021-28957) was discovered in the HTML Cleaner by Kevin Chung,
+  which allowed JavaScript to pass through.  The cleaner now removes the HTML5
+  ``formaction`` attribute.

[addCollapseLink(1, 1, 'Toggle comment display'); Comment 1 NATTkA bot 2021-03-21 19:52:53 UTC Comment hidden (obsolete)]

Unable to check for sanity:

> no match for package: dev-python/lxml-4.6.3

[addCollapseLink(2, 1, 'Toggle comment display'); Comment 2 NATTkA bot 2021-03-21 20:08:53 UTC Comment hidden (obsolete)]

Resetting sanity check; keywords are not fully specified and arches are not CC-ed.

[Comment 3 Sam James 2021-03-24 19:42:54 UTC]

sparc done

[Comment 4 Rolf Eike Beer 2021-03-25 06:41:07 UTC]

hppa stable

[Comment 5 Agostino Sarubbo 2021-03-25 18:13:09 UTC]

x86 stable

[Comment 6 Sam James 2021-03-25 23:12:55 UTC]

amd64 done

[Comment 7 Sam James 2021-03-25 23:17:50 UTC]

ppc done

[Comment 8 Sam James 2021-03-25 23:18:42 UTC]

ppc64 done

[Comment 9 Sam James 2021-03-26 00:22:17 UTC]

arm64 done

[Comment 10 Agostino Sarubbo 2021-03-26 11:51:07 UTC]

s390 stable

[Comment 11 Sam James 2021-03-27 16:05:02 UTC]

arm done

all arches done

[Comment 12 John Helmert III 2021-03-27 17:01:09 UTC]

Please cleanup

[addCollapseLink(13, 1, 'Toggle comment display'); Comment 13 NATTkA bot 2021-07-29 17:23:37 UTC Comment hidden (obsolete)]

Package list is empty or all packages have requested keywords.

[addCollapseLink(14, 1, 'Toggle comment display'); Comment 14 NATTkA bot 2021-07-29 17:32:01 UTC Comment hidden (obsolete)]

Package list is empty or all packages have requested keywords.

[addCollapseLink(15, 1, 'Toggle comment display'); Comment 15 NATTkA bot 2021-07-29 17:39:54 UTC Comment hidden (obsolete)]

Package list is empty or all packages have requested keywords.

[addCollapseLink(16, 1, 'Toggle comment display'); Comment 16 NATTkA bot 2021-07-29 17:48:06 UTC Comment hidden (obsolete)]

Package list is empty or all packages have requested keywords.

[addCollapseLink(17, 1, 'Toggle comment display'); Comment 17 NATTkA bot 2021-07-29 18:04:01 UTC Comment hidden (obsolete)]

Package list is empty or all packages have requested keywords.

[Comment 18 NATTkA bot 2021-07-29 18:12:20 UTC]

Package list is empty or all packages have requested keywords.

[Comment 19 John Helmert III 2022-08-09 23:05:55 UTC]

GLSA request filed.

[Comment 20 Larry the Git Cow 2022-08-10 04:18:31 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=00cb8ca9acda9480b2cbc77e709e6f1c6d0babf4

commit 00cb8ca9acda9480b2cbc77e709e6f1c6d0babf4
Author:     GLSAMaker <[e-mail]>
AuthorDate: 2022-08-10 03:53:32 +0000
Commit:     John Helmert III <[e-mail]>
CommitDate: 2022-08-10 04:16:21 +0000

    [ GLSA 202208-06 ] lxml: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/777579
    Bug: https://bugs.gentoo.org/829053
    Bug: https://bugs.gentoo.org/856598
    Signed-off-by: GLSAMaker <[e-mail]>
    Signed-off-by: John Helmert III <[e-mail]>

 glsa-202208-06.xml | 48 ++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)

[Comment 21 John Helmert III 2022-08-10 04:25:01 UTC]

GLSA released, all done!