A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behaviors between the sanitizer and the user's page. A remote attacker could exploit this flaw to run arbitrary HTML/JS code.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python38-requestsUpgrade python2-setuptoolsUpgrade python38-asn1cryptoUpgrade python2-docs-infoUpgrade python2-pyUpgrade python38-cffiUpgrade python38-psycopg2-docUpgrade python2-urllib3Upgrade python2-setuptools-wheelUpgrade python38-idnaUpgrade python2-backportsUpgrade python2-psycopg2Upgrade python2-chardetUpgrade python2-numpy-docUpgrade python2-sqlalchemyUpgrade python2-CythonUpgrade python2-docutilsUpgrade python2-numpyUpgrade python2-idnaUpgrade python38-psycopg2-testsUpgrade python38-cryptographyUpgrade python-sqlalchemy-docUpgrade python38-pysocksUpgrade python38-psycopg2Upgrade python2-pytest-mockUpgrade python2-PyMySQLUpgrade python2-pyyamlUpgrade python2-pluggyUpgrade python2-rpm-macrosUpgrade python2-attrsUpgrade python2-docsUpgrade python2-pytzUpgrade python2-sixUpgrade python38-sixUpgrade python2-requestsUpgrade python2-dnsUpgrade python38-pytzUpgrade python2-setuptools_scmUpgrade python38-chardetUpgrade python38-CythonUpgrade python38-pycparserUpgrade python2-backports-ssl_match_hostnameUpgrade python38-PyMySQLUpgrade python38-scipyUpgrade python-psycopg2-docUpgrade python2-psycopg2-testsUpgrade python2-psycopg2-debugUpgrade python2-numpy-f2pyUpgrade python38-mod_wsgiUpgrade python2-ipaddressUpgrade python2-pysocksUpgrade python2-mockUpgrade python2-coverageUpgrade python2-funcsigsUpgrade python2-markupsafeUpgrade python2-pytestUpgrade python38-markupsafeUpgrade python38-ply | May 4, 2022 | Dec 3, 2020 |
| Alpine Linux | — | Upgrade py3-lxml | Jan 5, 2021 | Dec 3, 2020 |
| Amazon Linux Ami 2 | — | Upgrade python-lxml-docsUpgrade python-lxmlUpgrade python-lxml-debuginfo | Jun 24, 2021 | Dec 3, 2020 |
| Amazon_linux | — | Upgrade python-lxml | Mar 23, 2023 | Dec 3, 2020 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Dec 3, 2020 |
| Centos_linux | — | Upgrade python38-tkinterUpgrade python38-debugUpgrade python2-psycopg2Upgrade python2-pymongoUpgrade python38-Cython-debuginfoUpgrade python2-psycopg2-debuginfoUpgrade python2-numpy-docUpgrade python38-markupsafe-debuginfoUpgrade python38-psycopg2-testsUpgrade babelUpgrade python38-scipy-debuginfoUpgrade python2-pysocksUpgrade python2-sqlalchemyUpgrade python2-lxmlUpgrade python2-wheel-wheelUpgrade python-psutil-debugsourceUpgrade python2-develUpgrade python38-pyyamlUpgrade python38-wheel-wheelUpgrade scipy-debugsourceUpgrade python2-requestsUpgrade python38-psycopg2-debuginfoUpgrade python38-numpy-docUpgrade python3-lxmlUpgrade python2-virtualenvUpgrade python38-numpy-f2pyUpgrade python-markupsafe-debugsourceUpgrade python38-cryptography-debuginfoUpgrade python38-psycopg2-docUpgrade python38-rpm-macrosUpgrade python38-wheelUpgrade python38-develUpgrade python38-psycopg2Upgrade python2-pyyaml-debuginfoUpgrade python38-requestsUpgrade python2-pygmentsUpgrade python38-setuptools-wheelUpgrade numpy-debugsourceUpgrade python2-setuptools_scmUpgrade python2-docsUpgrade python2-pytest-mockUpgrade python2-funcsigsUpgrade python-psycopg2-debugsourceUpgrade python2-tkinterUpgrade python2-scipyUpgrade python2-urllib3Upgrade python38-cffi-debuginfoUpgrade python2-scipy-debuginfoUpgrade python38-plyUpgrade python2-coverage-debuginfoUpgrade python38-jinja2Upgrade python38-pytzUpgrade python38-idnaUpgrade python38-psutil-debuginfoUpgrade python2-idnaUpgrade python2-pluggyUpgrade python2-PyMySQLUpgrade python2-setuptoolsUpgrade python2-markupsafeUpgrade python38-setuptoolsUpgrade python2-debugsourceUpgrade python2-pymongo-debuginfoUpgrade python38-mod_wsgiUpgrade python38-pycparserUpgrade Cython-debugsourceUpgrade python2-psycopg2-testsUpgrade python-sqlalchemy-docUpgrade python38-asn1cryptoUpgrade python-nose-docsUpgrade python2-rpm-macrosUpgrade python-cryptography-debugsourceUpgrade python38-PyMySQLUpgrade python38Upgrade python2-bsonUpgrade python2-debuginfoUpgrade python38-testUpgrade python38-numpyUpgrade python2-libsUpgrade python2-debugUpgrade python38-pipUpgrade python38-markupsafeUpgrade python38-CythonUpgrade python38-cryptographyUpgrade python3-lxml-debuginfoUpgrade python2-toolsUpgrade python2-testUpgrade python2-psycopg2-debugUpgrade python2-pip-wheelUpgrade python2-numpy-f2pyUpgrade python2-lxml-debuginfoUpgrade python2-dnsUpgrade python2-backports-ssl_match_hostnameUpgrade python38-scipyUpgrade python2-backportsUpgrade python2-mockUpgrade PyYAML-debugsourceUpgrade python2-pyyamlUpgrade python2-jinja2Upgrade python2-Cython-debuginfoUpgrade python2-CythonUpgrade python2-bson-debuginfoUpgrade python2-babelUpgrade python-coverage-debugsourceUpgrade python38-lxml-debuginfoUpgrade python-cffi-debugsourceUpgrade python38-lxmlUpgrade python2-docs-infoUpgrade python38-idleUpgrade python2-wheelUpgrade python38-sixUpgrade python38-cffiUpgrade python2-psycopg2-debug-debuginfoUpgrade python2-noseUpgrade python2-docutilsUpgrade python2-pytestUpgrade python38-urllib3Upgrade python2-sixUpgrade python2-numpyUpgrade python38-numpy-debuginfoUpgrade python2-coverageUpgrade python38-libsUpgrade python38-chardetUpgrade python2-pytzUpgrade python2-pymongo-gridfsUpgrade python-psycopg2-debuginfoUpgrade python-lxml-debugsourceUpgrade python2-pyUpgrade python38-babelUpgrade python2-setuptools-wheelUpgrade python38-pip-wheelUpgrade python38-debugsourceUpgrade python-pymongo-debugsourceUpgrade python38-psutilUpgrade python38-pyyaml-debuginfoUpgrade python-psycopg2-docUpgrade python2-pipUpgrade python38-pysocksUpgrade python2Upgrade python-pymongo-debuginfoUpgrade python2-attrsUpgrade python2-numpy-debuginfoUpgrade python2-ipaddressUpgrade python2-chardetUpgrade python38-debuginfo | Jun 1, 2021 | Dec 3, 2020 |
| Debian | — | Upgrade lxml | Nov 30, 2020 | Nov 30, 2020 |
| Huawei Euleros 2_0_sp2 | — | Upgrade python-lxml | Sep 16, 2021 | Dec 3, 2020 |
| Huawei Euleros 2_0_sp3 | — | Upgrade python-lxml | Apr 30, 2021 | Dec 3, 2020 |
| Huawei Euleros 2_0_sp5 | — | Upgrade python-lxml | Mar 24, 2021 | Dec 3, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade python3-lxmlUpgrade python-lxmlUpgrade python2-lxml | Feb 2, 2021 | Dec 3, 2020 |
| Huawei Euleros 2_0_sp9 | — | Upgrade python3-lxml | Jan 5, 2021 | Dec 3, 2020 |
| Oracle Solaris | — | Upgrade library/python/lxml to version 4.6.2-11.4.31.0.1.88.2 on Solaris 11.4Upgrade library/python/lxml-39 to version 4.6.2-11.4.31.0.1.88.2 on Solaris 11.4Upgrade library/python/lxml-37 to version 4.6.2-11.4.31.0.1.88.2 on Solaris 11.4Upgrade library/python/lxml-27 to version 4.6.2-11.4.31.0.1.88.2 on Solaris 11.4 | Mar 17, 2021 | Dec 3, 2020 |
| Oracle_linux | — | Upgrade python2-urllib3Upgrade python2-pipUpgrade python38-numpy-f2pyUpgrade python38Upgrade python-nose-docsUpgrade python38-urllib3Upgrade python38-setuptools-wheelUpgrade python38-numpyUpgrade python2-setuptools-wheelUpgrade python2-rpm-macrosUpgrade python2-backportsUpgrade python38-testUpgrade python2-wheel-wheelUpgrade python38-psycopg2-testsUpgrade python2-noseUpgrade python2-backports-ssl_match_hostnameUpgrade python-psycopg2-docUpgrade python38-scipyUpgrade python2-pyyamlUpgrade python2-debugUpgrade python38-jinja2Upgrade python38-cffiUpgrade python38-idleUpgrade python38-numpy-docUpgrade python38-wheelUpgrade python2-pluggyUpgrade python38-plyUpgrade python38-idnaUpgrade python2-idnaUpgrade python38-pysocksUpgrade python38-pip-wheelUpgrade python2-psycopg2Upgrade python2-mockUpgrade python38-babelUpgrade ol-automation-manager-cliUpgrade python2-jinja2Upgrade python38-libsUpgrade python38-cryptographyUpgrade python2-wheelUpgrade python2-numpy-f2pyUpgrade python38-psutilUpgrade python38-psycopg2-docUpgrade python38-markupsafeUpgrade python2-sixUpgrade python2-libsUpgrade python2-chardetUpgrade python2-babelUpgrade babelUpgrade python2-numpyUpgrade python2-docsUpgrade python2-setuptoolsUpgrade python2-psycopg2-debugUpgrade python3-olamkitUpgrade python38-chardetUpgrade python38-wheel-wheelUpgrade python38-requestsUpgrade python38-setuptoolsUpgrade python2-PyMySQLUpgrade python2-pyUpgrade python2-pytestUpgrade python2-pytzUpgrade python2-sqlalchemyUpgrade python38-mod_wsgiUpgrade python2-testUpgrade python2-numpy-docUpgrade python2-ipaddressUpgrade python2-pip-wheelUpgrade python2-develUpgrade python2-tkinterUpgrade python38-debugUpgrade python2-bsonUpgrade python38-asn1cryptoUpgrade python2-virtualenvUpgrade python38-pycparserUpgrade python2-markupsafeUpgrade python2-pymongoUpgrade python2-attrsUpgrade python2-docutilsUpgrade python38-pipUpgrade python2-lxmlUpgrade python2-pymongo-gridfsUpgrade python2-requestsUpgrade python38-psycopg2Upgrade python-sqlalchemy-docUpgrade python2-dnsUpgrade python2-docs-infoUpgrade python38-CythonUpgrade python38-sixUpgrade python2-scipyUpgrade python38-pyyamlUpgrade python2Upgrade python2-toolsUpgrade python38-develUpgrade python38-PyMySQLUpgrade python2-CythonUpgrade python2-pysocksUpgrade python2-psycopg2-testsUpgrade python2-pytest-mockUpgrade python2-pygmentsUpgrade ol-automation-managerUpgrade python2-coverageUpgrade python2-setuptools_scmUpgrade python3-lxmlUpgrade python38-pytzUpgrade python38-lxmlUpgrade python38-rpm-macrosUpgrade python2-funcsigsUpgrade python38-tkinter | May 26, 2021 | Oct 18, 2020 |
| Redhat_linux | — | Upgrade python38-PyMySQLUpgrade python2-pysocksUpgrade python38-markupsafeUpgrade python38-libsUpgrade python38-numpy-debuginfoUpgrade python38-psycopg2-testsUpgrade python38-setuptools-wheelUpgrade python-coverage-debugsourceUpgrade python38-numpy-f2pyUpgrade python38-numpyUpgrade python2-pygmentsUpgrade python38-debugUpgrade python-psycopg2-docUpgrade python2-testUpgrade python38-babelUpgrade python38-scipyUpgrade python2-CythonUpgrade python2-requestsUpgrade python2-libsUpgrade python38-cryptography-debuginfoUpgrade python2-pip-wheelUpgrade python38-debuginfoUpgrade python38-idnaUpgrade python2-pytestUpgrade python2-psycopg2-debugUpgrade python38-Cython-debuginfoUpgrade python38-numpy-docUpgrade python38-testUpgrade python2-scipyUpgrade python2-psycopg2-debuginfoUpgrade python2-chardetUpgrade python2-attrsUpgrade python2-pymongo-gridfsUpgrade python2-jinja2Upgrade python2-docs-infoUpgrade python2-develUpgrade python38-CythonUpgrade python2-numpy-f2pyUpgrade python2-coverage-debuginfoUpgrade python2-setuptools_scmUpgrade python38-cffiUpgrade python38-pycparserUpgrade python2-wheel-wheelUpgrade python38-wheelUpgrade python2-pymongo-debuginfoUpgrade python2-virtualenvUpgrade python38-markupsafe-debuginfoUpgrade python-cffi-debugsourceUpgrade python2-sixUpgrade python2-pyUpgrade python2-psycopg2-debug-debuginfoUpgrade python38-psutilUpgrade python2-backportsUpgrade python38-asn1cryptoUpgrade python38-pytzUpgrade python38Upgrade python-markupsafe-debugsourceUpgrade python2-pyyaml-debuginfoUpgrade python2-numpyUpgrade python2-debuginfoUpgrade python-pymongo-debugsourceUpgrade python38-lxml-debuginfoUpgrade python38-pipUpgrade python2-pytzUpgrade python2Upgrade python-psutil-debugsourceUpgrade python2-pipUpgrade PyYAML-debugsourceUpgrade python38-sixUpgrade python2-urllib3Upgrade python2-wheelUpgrade python38-pyyaml-debuginfoUpgrade python2-markupsafeUpgrade numpy-debugsourceUpgrade python2-babelUpgrade scipy-debugsourceUpgrade python38-chardetUpgrade python2-backports-ssl_match_hostnameUpgrade python-psycopg2-debugsourceUpgrade python2-pymongoUpgrade Cython-debugsourceUpgrade python2-docsUpgrade python2-tkinterUpgrade python2-psycopg2Upgrade python38-tkinterUpgrade python38-cffi-debuginfoUpgrade python2-setuptoolsUpgrade python38-psutil-debuginfoUpgrade python2-toolsUpgrade python2-debugUpgrade python2-ipaddressUpgrade python-psycopg2-debuginfoUpgrade python38-mod_wsgiUpgrade python2-rpm-macrosUpgrade python38-urllib3Upgrade python38-cryptographyUpgrade python38-psycopg2-docUpgrade python2-scipy-debuginfoUpgrade python38-setuptoolsUpgrade python38-wheel-wheelUpgrade python2-psycopg2-testsUpgrade python2-lxmlUpgrade python2-sqlalchemyUpgrade python-pymongo-debuginfoUpgrade python2-pytest-mockUpgrade python2-setuptools-wheelUpgrade python38-jinja2Upgrade python38-pyyamlUpgrade python38-pysocksUpgrade python38-rpm-macrosUpgrade python2-Cython-debuginfoUpgrade python2-dnsUpgrade python38-psycopg2-debuginfoUpgrade python38-pip-wheelUpgrade python38-psycopg2Upgrade python3-lxmlUpgrade python38-debugsourceUpgrade python-cryptography-debugsourceUpgrade python2-bson-debuginfoUpgrade python2-debugsourceUpgrade python-lxml-debugsourceUpgrade python2-PyMySQLUpgrade python2-funcsigsUpgrade python2-lxml-debuginfoUpgrade python38-lxmlUpgrade python2-idnaUpgrade python38-requestsUpgrade python2-pyyamlUpgrade python2-noseUpgrade babelUpgrade python2-numpy-debuginfoUpgrade python2-coverageUpgrade python-sqlalchemy-docUpgrade python-nose-docsUpgrade python38-develNo solution existsUpgrade python2-pluggyUpgrade python2-numpy-docUpgrade python38-plyUpgrade python2-bsonUpgrade python2-mockUpgrade python3-lxml-debuginfoUpgrade python38-idleUpgrade python38-scipy-debuginfoUpgrade python2-docutils | May 21, 2021 | Dec 3, 2020 |
| Rocky_linux | — | Upgrade python2-libsUpgrade python2-debugsourceUpgrade python2-debuginfoUpgrade numpy-debugsourceUpgrade python-cryptography-debugsourceUpgrade python2-psycopg2-debug-debuginfoUpgrade python38-numpy-debuginfoUpgrade python2-numpy-f2pyUpgrade python38-CythonUpgrade python2Upgrade python2-Cython-debuginfoUpgrade python38-markupsafeUpgrade python-psutil-debugsourceUpgrade python-psycopg2-docUpgrade python38Upgrade python38-debuginfoUpgrade PyYAML-debugsourceUpgrade python38-debugsourceUpgrade python2-coverage-debuginfoUpgrade python2-markupsafeUpgrade python38-debugUpgrade python38-scipyUpgrade python2-testUpgrade python2-backportsUpgrade python2-numpyUpgrade python2-lxml-debuginfoUpgrade python2-psycopg2-testsUpgrade python38-Cython-debuginfoUpgrade python-pymongo-debugsourceUpgrade python38-pyyamlUpgrade python2-bsonUpgrade python3-lxml-debuginfoUpgrade python38-scipy-debuginfoUpgrade python2-CythonUpgrade python-coverage-debugsourceUpgrade python2-psycopg2-debugUpgrade python-cffi-debugsourceUpgrade python38-lxml-debuginfoUpgrade python2-pymongo-gridfsUpgrade python38-pyyaml-debuginfoUpgrade python38-psycopg2-testsUpgrade python2-scipyUpgrade python38-mod_wsgiUpgrade python38-cryptographyUpgrade python2-pyyamlUpgrade python2-coverageUpgrade python2-bson-debuginfoUpgrade scipy-debugsourceUpgrade python-psycopg2-debuginfoUpgrade python38-idleUpgrade python38-cryptography-debuginfoUpgrade python38-lxmlUpgrade python38-psycopg2Upgrade python38-numpy-f2pyUpgrade python38-cffiUpgrade python38-psycopg2-docUpgrade python38-psycopg2-debuginfoUpgrade python38-develUpgrade python2-debugUpgrade python38-markupsafe-debuginfoUpgrade python2-sqlalchemyUpgrade python38-libsUpgrade python-lxml-debugsourceUpgrade python3-lxmlUpgrade python38-testUpgrade python2-tkinterUpgrade python2-pyyaml-debuginfoUpgrade python2-psycopg2Upgrade Cython-debugsourceUpgrade python-markupsafe-debugsourceUpgrade python38-numpyUpgrade python-psycopg2-debugsourceUpgrade python38-psutilUpgrade python2-pymongo-debuginfoUpgrade python-pymongo-debuginfoUpgrade python2-scipy-debuginfoUpgrade python2-develUpgrade python2-psycopg2-debuginfoUpgrade python2-pymongoUpgrade python2-numpy-debuginfoUpgrade python38-cffi-debuginfoUpgrade python38-psutil-debuginfoUpgrade python2-toolsUpgrade python38-tkinterUpgrade python2-lxml | Mar 12, 2024 | Dec 3, 2020 |
| Suse | — | Upgrade python-lxmlUpgrade python3-lxmlUpgrade python2-lxml-develUpgrade python2-lxmlUpgrade python3-lxml-devel | Mar 12, 2022 | Dec 3, 2020 |
| Ubuntu | — | Upgrade python3-lxml (Ubuntu Pro)Upgrade python3-lxmlUpgrade python-lxmlUpgrade python-lxml (Ubuntu Pro) | Dec 10, 2020 | Dec 3, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Dec 3, 2020 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub