Bug 1941534 (CVE-2021-28957)
| Summary: | CVE-2021-28957 python-lxml: Missing input sanitization for formaction HTML5 attributes may lead to XSS | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Marian Rehak <mrehak> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | apevec, bcoca, chousekn, cmeyers, davidn, gblomqui, hhorak, igor.raits, jcammara, jhardy, jjoyce, jobarker, jorton, jpopelka, jschluet, lhh, lpeer, mabashia, mburns, me, mizdebsk, notting, osapryki, python-maint, redhat-bugzilla, relrod, rschiron, sclewis, sdoran, slinaber, smcdonal, tkuratom |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | python-lxml 4.6.3 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A flaw was found in python-lxml. The HTML5 formaction attribute is not input sanitized like the HTML action attribute is which can lead to a Cross-Site Scripting attack (XSS) when an application uses python-lxml to sanitize user inputs. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2021-08-24 15:35:08 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1941535, 1941690, 1941709, 1941710, 1941711, 1941712, 1941713, 1941910, 1941955, 1946880, 1946881, 1946882, 1969519 | ||
| Bug Blocks: | 1941538 | ||
|
Description
Marian Rehak
2021-03-22 10:37:38 UTC
Created python-lxml tracking bugs for this issue: Affects: fedora-all [bug 1941535] Created python3-lxml tracking bugs for this issue: Affects: epel-all [bug 1941690] python-lxml with the lxml.html.clean.Cleaner class allows to clean documents of each of the possible offending elements, like `javascript:`, script tags, etc. However, due to this flaw it did not clean possibly offending elements in the "formaction" attribute of buttons and similar HTML objects, because the attribute was not considered one to look for links. Completed analysis for Ansible Tower and AAP 1.2 and found that, though lxml affected version is being used, its just that Not in a vulnerable way. That is, there is no usage of HTML Cleaner lib/function along with formaction attribute. Hence, marking both Tower and AAP 1.2 as "Not Affected". Lowering the impact for Tower and AAP 1.2 from Moderate to Low as the concerned function/attribute which causes this vulnerability is not in use. Statement: Web applications vulnerable to this flaw, where a XSS attack can be accomplished, are only those that use python-lxml to sanitize HTML input and that allow user data to be placed in the "formaction" attribute of a form button. In Red Hat OpenStack Platform, because the flaw has a lower impact and the package is unlikely to be exploited in the RHOSP environment, no update will be provided at this time for the RHOSP python-lxml package. For Ansible Tower and Ansible Automation Platform, Lowering the impact from Moderate to Low as the vulnerable function i.e. lxml HTML Cleaner and the vulnerable attribute i.e. HTML FormAction are not being used. FEDORA-2021-4cdb0f68c7 has been pushed to the Fedora 33 stable repository. If problem still persists, please make note of it in this bug report. This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS Via RHSA-2021:3254 https://access.redhat.com/errata/RHSA-2021:3254 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2021-28957 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2021:4151 https://access.redhat.com/errata/RHSA-2021:4151 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2021:4158 https://access.redhat.com/errata/RHSA-2021:4158 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2021:4160 https://access.redhat.com/errata/RHSA-2021:4160 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2021:4162 https://access.redhat.com/errata/RHSA-2021:4162 |