CVE-2021-28957 lxml vulnerable to Cross-Site Scripting
Remote attackers can execute arbitrary JavaScript via XSS in python-lxml when specific sanitizer options are disabled, affecting applications using the library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-28957?
CVE-2021-28957 is a medium-severity cross-site scripting vulnerability in Debian Debian Linux, published on 21 Mar 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS code on users who interact with incorrectly sanitized HTML. This issue is patched in lxml 4.6.3.
Weakness: CWE-79
Which versions are affected by CVE-2021-28957?
3 open source packages ship an affected version, including lxml. It affects 5 products.
| Package | Affected | Fixed in |
|---|---|---|
lxml PyPI | All versions | 4.6.3 |
lxml PyPI | All versions | 4.6.3 |
lxml PyPI | All versions | 4.6.3 |
Linux distribution packages (11)
python3-lxml AlmaLinux:8 | All versions | 4.2.3-3.el8 |
python-lxml Red Hat:enterprise_linux:8::appstream | All versions | 0:4.2.3-3.el8 |
python-lxml-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 0:4.2.3-3.el8 |
python3-lxml Red Hat:enterprise_linux:8::appstream | All versions | 0:4.2.3-3.el8 |
python3-lxml-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:4.2.3-3.el8 |
python-lxml Rocky Linux:8 | All versions | 0:4.2.3-3.el8 |
python3-lxml SUSE:Linux Enterprise Module for Public Cloud 12 | All versions | 3.3.5-3.15.1 |
python3-lxml SUSE:Linux Enterprise Server 12 SP5 | All versions | 3.6.1-3.6.1 |
python3-lxml SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 3.6.1-3.6.1 |
translate-toolkit openSUSE:Tumbleweed | All versions | 3.14.5-1.1 |
translate-toolkit openSUSE:Tumbleweed | All versions | 3.3.6-1.3 |
Products include Debian Debian Linux, Fedoraproject Fedora, Lxml Lxml, Netapp Snapcenter, Oracle Zfs Storage Appliance Kit.
How do I fix CVE-2021-28957?
Upgrade lxml to 4.6.3 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2021-28957 being exploited?
There is no known exploitation of CVE-2021-28957 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2021-28957, ALSA-2021:4158, AZL-6808, DEBIAN-CVE-2021-28957, DLA-2606-1, DSA-4880-1 and 13 more.