CVE-2021-43818
High
Description
lxml is a library for processing XML and HTML in the Python language. Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG files embedded using data URIs. Users that employ the HTML cleaner in a security relevant context should upgrade to lxml 4.6.5 to receive a patch. There are no known workarounds available.
SeverityHigh
CVSS8.2
Exploit probability—
Product
Lxml
PublishedDec 13, 2021
First seenDec 13, 2021
Weakness typeCWE-74InjectionCWE-79Cross-site scripting (XSS)
How to fix
Update
- lxml lxml4.6.5 or later
- lxml4.6.5 or later
Vendor advisories
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQ4SPKJX3RRJK4UWA6FXCRHD2TVRQI44/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WZGNET2A4WGLSUXLBFYKNC5PXHQMI3I7/
- debian.org/security/2022/dsa-5043
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TUIS2KE3HZ2AAQKXFLTJFZPP2IFHJTC7/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V2XMOM5PFT6U5AAXY6EFNT5JZCKKHK2V/
- security.gentoo.org/glsa/202208-06
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| lxml lxml | v < 4.6.5 | 4.6.5 |
| fedoraproject fedora | 34, 35 | — |
| debian debian_linux | 9.0, 10.0, 11.0 | — |
| netapp solidfire | No range specified | — |
| netapp solidfire_enterprise_sds | No range specified | — |
| netapp hci_storage_node_firmware | No range specified | — |
| oracle communications_cloud_native_core_binding_support_function | 22.1.3 | — |
| oracle communications_cloud_native_core_network_exposure_function | 22.1.1 | — |
| oracle communications_cloud_native_core_policy | 22.2.0 | — |
| oracle http_server | 12.2.1.3.0, 12.2.1.4.0 | — |
| oracle zfs_storage_appliance_kit | 8.8 | — |
| lxmlPyPI | v < 4.6.5 | 4.6.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.