UbuntuUpdates.org

Package "python-lxml"

Name: python-lxml

Description:

pythonic binding for the libxml2 and libxslt libraries
Latest version: 4.2.1-1ubuntu0.6
Release: bionic (18.04)
Level: security
Repository: main
Head package: lxml
Homepage: http://lxml.de/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "python-lxml"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "python-lxml" in Bionic

Repository Area Version
base main 4.2.1-1
updates main 4.2.1-1ubuntu0.6

Changelog

Version: 4.2.1-1ubuntu0.6 2022-01-12 15:07:07 UTC

  lxml (4.2.1-1ubuntu0.6) bionic-security; urgency=medium

  * SECURITY UPDATE: XSS vulnerability
    - debian/patches/CVE-2021-43818-*.patch: prevent "@import"
      from re-occurring in the CSS after replacements and remove
      SVG image data URLs since they can embed script content in
      src/lxml/html/clean.py, src/html/tests/test_clean.py.
    - CVE-2021-43818

 -- Leonidas Da Silva Barbosa <email address hidden> Tue, 04 Jan 2022 10:51:53 -0300
Source diff to previous version
CVE-2021-43818 lxml is a library for processing XML and HTML in the Python language. Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted scri

Version: 4.2.1-1ubuntu0.4 2021-03-30 18:06:23 UTC

  lxml (4.2.1-1ubuntu0.4) bionic-security; urgency=medium

  * SECURITY UPDATE: incorrect formaction attribute input sanitization
    - debian/patches/CVE-2021-28957.patch: add HTML-5 formaction attribute
      to defs.link_attrs in src/lxml/html/defs.py,
      src/lxml/html/tests/test_clean.py.
    - CVE-2021-28957

 -- Marc Deslauriers <email address hidden> Mon, 29 Mar 2021 12:04:43 -0400
Source diff to previous version
CVE-2021-28957 lxml 4.6.2 allows XSS. It places the HTML action attribute into defs.link_attrs (in html/defs.py) for later use in input sanitization, but does not d

Version: 4.2.1-1ubuntu0.3 2020-12-11 02:06:22 UTC

  lxml (4.2.1-1ubuntu0.3) bionic-security; urgency=medium

  * SECURITY UPDATE: XSS vulnerability
    - debian/patches/CVE-2020-27783-part2.patch:
      This adds the missing part reported from upstream
      Prevent combinations of <noscript> and <style> to sneak
      JS through the HTML cleaner in src/lxml/html/clean.py,
      src/lxml/html/tests/test_clean.py.
    - CVE-2020-27783
  * Adding --with-cython to debian/rules in order to it build compile the .py
    files changed and regenerate the .c files to the binaries.

 -- Leonidas Da Silva Barbosa <email address hidden> Thu, 10 Dec 2020 14:18:33 -0300
Source diff to previous version
CVE-2020-27783 A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behavi

Version: 4.2.1-1ubuntu0.2 2020-12-09 15:06:24 UTC

  lxml (4.2.1-1ubuntu0.2) bionic-security; urgency=medium

  * SECURITY UPDATE: XSS vulnerability
    - Prevent combinations of <noscript> and <style> to sneak
      JS through the HTML cleaner in src/lxml/html/clean.py,
      src/lxml/html/tests/test_clean.py.
    - CVE-2020-27783

 -- Leonidas Da Silva Barbosa <email address hidden> Tue, 08 Dec 2020 13:53:38 -0300
Source diff to previous version
CVE-2020-27783 A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behavi

Version: 4.2.1-1ubuntu0.1 2018-12-10 13:06:19 UTC

  lxml (4.2.1-1ubuntu0.1) bionic-security; urgency=medium

  * SECURITY UPDATE: XSS attacks
    - debian/patches/CVE-2018-19787.patch:
      Make the cleaner remove javascript URLs
      that use espacing in in src/lxml/html/clean.py,
      src/lxml/html/tests/test_clean.txt.
    - CVE-2018-19787

 -- <email address hidden> (Leonidas S. Barbosa) Fri, 07 Dec 2018 09:50:09 -0300
CVE-2018-19787 An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, al


About   -   Send Feedback to @ubuntu_updates