CVE-2021-43818

Katalog CVE

CVSS 7.1 · High EPSS 2,7%

Kerentanan Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') pada lxml, fedoraproject fedora +9 lainnya. Skor CVSS 3.1 7.1 (High) menurut NVD.

Deskripsi (NVD)

lxml is a library for processing XML and HTML in the Python language. Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG files embedded using data URIs. Users that employ the HTML cleaner in a security relevant context should upgrade to lxml 4.6.5 to receive a patch. There are no known workarounds available.

Rincian

Terbit di NVD

13 Desember 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

2,7% peluang dieksploitasi; lebih tinggi dari 85,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/lxml/lxml/commit/12fa9669007180a7bb87d990c375cf91ca5b664a patch · advisory pihak ketiga
• https://github.com/lxml/lxml/commit/a3eacbc0dcf1de1c822ec29fb7d090a4b1712a9c#diff-59130575b4fb2932c957db292297... patch · advisory pihak ketiga
• https://github.com/lxml/lxml/commit/f2330237440df7e8f39c3ad1b1aa8852be3b27c0 patch · advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpuapr2022.html patch · advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpujul2022.html patch · advisory pihak ketiga
• https://github.com/lxml/lxml/security/advisories/GHSA-55x5-fj6c-h6m8 advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2021/12/msg00037.html mailing list · advisory pihak ketiga
• https://security.gentoo.org/glsa/202208-06 advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20220107-0005/ advisory pihak ketiga
• https://www.debian.org/security/2022/dsa-5043 advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TUIS2KE3HZ2AA...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V2XMOM5PFT6U5...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WZGNET2A4WGLS...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQ4SPKJX3RRJK...