An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safeattrsonly and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS code on users who interact with incorrectly sanitized HTML. This issue is patched in lxml 4.6.3.
{ "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "3.3.3-1ubuntu0.2+esm3", "binary_name": "python-lxml" }, { "binary_version": "3.3.3-1ubuntu0.2+esm3", "binary_name": "python-lxml-dbg" }, { "binary_version": "3.3.3-1ubuntu0.2+esm3", "binary_name": "python-lxml-dbgsym" }, { "binary_version": "3.3.3-1ubuntu0.2+esm3", "binary_name": "python-lxml-doc" }, { "binary_version": "3.3.3-1ubuntu0.2+esm3", "binary_name": "python3-lxml" }, { "binary_version": "3.3.3-1ubuntu0.2+esm3", "binary_name": "python3-lxml-dbg" }, { "binary_version": "3.3.3-1ubuntu0.2+esm3", "binary_name": "python3-lxml-dbgsym" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "3.5.0-1ubuntu0.4", "binary_name": "python-lxml" }, { "binary_version": "3.5.0-1ubuntu0.4", "binary_name": "python-lxml-dbg" }, { "binary_version": "3.5.0-1ubuntu0.4", "binary_name": "python-lxml-doc" }, { "binary_version": "3.5.0-1ubuntu0.4", "binary_name": "python3-lxml" }, { "binary_version": "3.5.0-1ubuntu0.4", "binary_name": "python3-lxml-dbg" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "4.2.1-1ubuntu0.4", "binary_name": "python-lxml" }, { "binary_version": "4.2.1-1ubuntu0.4", "binary_name": "python-lxml-dbg" }, { "binary_version": "4.2.1-1ubuntu0.4", "binary_name": "python-lxml-doc" }, { "binary_version": "4.2.1-1ubuntu0.4", "binary_name": "python3-lxml" }, { "binary_version": "4.2.1-1ubuntu0.4", "binary_name": "python3-lxml-dbg" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "4.5.0-1ubuntu0.3", "binary_name": "python-lxml" }, { "binary_version": "4.5.0-1ubuntu0.3", "binary_name": "python-lxml-dbg" }, { "binary_version": "4.5.0-1ubuntu0.3", "binary_name": "python-lxml-doc" }, { "binary_version": "4.5.0-1ubuntu0.3", "binary_name": "python3-lxml" }, { "binary_version": "4.5.0-1ubuntu0.3", "binary_name": "python3-lxml-dbg" } ] }