Skip to content
OpenAdvisories
High ALAS2-2023-1956 3 CVEs

Important: python-lxml security update (Amazon Linux 2)

Published Feb 17, 2023 · Updated Mar 7, 2025

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-43818: There's a flaw in python-lxml's HTML Cleaner component, which is responsible for sanitizing HTML and Javascript. An attacker who is able to submit a crafted payload to a web service using python-lxml's HTML Cleaner may be able to trigger script execution in clients such as web browsers. This can occur because the HTML Cleaner did not remove scripts within SVG images in data URLs such as <img src=>. XSS can result in impacts to the integrity and availability of the web page, as well as a potential impact to data confidentiality in some circumstances. CVE-2018-19787: An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by "j a v a s c r i p t:" in Internet Explorer. This is a similar issue to CVE-2014-3146. CVE-2014-3146: Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via control characters in the link scheme to the clean_html function.

Fixed packages 3

ReleasePackageFixed in
Amazon Linux · 2 python-lxml 0:3.2.1-4.amzn2.0.4
Amazon Linux · 2 python-lxml-debuginfo 0:3.2.1-4.amzn2.0.4
Amazon Linux · 2 python-lxml-docs 0:3.2.1-4.amzn2.0.4

Vulnerabilities 3

  • High 8.2
    CVE-2021-43818

    HTML Cleaner allows crafted and SVG embedded scripts to pass through

    lxml is a library for processing XML and HTML in the Python language. Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG files embedded using data URIs. Users that employ th…

    lxml lxml lxml lxml Debian Ubuntu Azure Linux Alpine PyPI
  • Medium 6.1
    CVE-2014-3146 Public exploit

    lxml Cross-site Scripting Via Control Characters

    Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via control characters in the link scheme to the clean_html function.

    lxml lxml lxml Debian Ubuntu PyPI
  • Medium 6.1
    CVE-2018-19787

    Improper Neutralization of Input During Web Page Generation in LXML

    An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by "j a v a s c r i p t:" in Internet Explore…

    lxml lxml python-lxml lxml Debian Ubuntu Azure Linux PyPI

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2014-3146.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2018-19787.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-43818.html