openSUSE: Security Advisory for python-bleach (openSUSE-SU-2020:0308-1)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

OPENSUSE-SU-2020:0308-1 Security update for python-bleach

This update for python-bleach to version 3.1.1 fixes the following issue: - Python-bleach was updated to 3.1.1 - CVE-2020-6802: Fixed mutation XSS vulnerabilities boo1165303...

Security update for python-bleach (important)

openSUSE Security Update: Security update for python-bleach Announcement ID: openSUSE-SU-2020:0308-1 Rating: important References: 1165303 Cross-References: CVE-2020-6802 Affected Products: openSUSE Leap 15.1 An update that fixes one vulnerability is now available. Description: This update for...

Updated python-bleach packages fix security vulnerability

The updated packages fix a security vulnerability: Mutation XSS in bleach.clean when noscript and raw tag whitelisted. CVE-2020-6802...

MGASA-2020-0125 Updated python-bleach packages fix security vulnerability

The updated packages fix a security vulnerability: Mutation XSS in bleach.clean when noscript and raw tag whitelisted. CVE-2020-6802...

Mozilla Bleach Cross-Site Scripting Vulnerability

Mozilla Bleach is an HTML cleanup library from the Mozilla Foundation in the United States. A cross-site scripting vulnerability exists in Mozilla Bleach versions prior to 3.11. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can...

Debian DSA-4636-1 : python-bleach - security update

It was reported that python-bleach, a whitelist-based HTML-sanitizing library, is prone to a mutation XSS vulnerability in bleach.clean when'noscript' and one or more raw text tags were whitelisted. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

Debian: Security Advisory (DSA-4636-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DSA 4636-1] python-bleach security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4636-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso February 28, 2020 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4636-1] python-bleach security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4636-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso February 28, 2020 https://www.debian.org/security/faq -...

DSA-4636-1 python-bleach - security update

Bulletin has no description...

Cross-Site Scripting (XSS)

bleach is vulnerable to cross-site scripting XSS. Invocation of bleach.clean method with a scripting parameter set to FALSE and a raw tags such as title, textarea, script, style, noembed, noframes, iframe, xmp allows BleachHTMLParser to process user-contributed content using innerHTML property,...

adversarial-labeller (=0.1.8), alo7-airflow (>=1.10.0 <=1.10.0.7) +113 more potentially affected by CVE-2020-6802 via bleach (>=1.2.2 <=3.1.0)

bleach PYPI version =1.2.2, =1.10.0, =0.1.0, =0.0.6, =0.3.0, =0.3.4, =0.0.5, =0.1.3, =0.0.1, =0.2.1, =1.0.2, =0.1.2, =1.0.7 and more Source cves: CVE-2020-6802 Source advisory: OSV:GHSA-Q65M-PV3F-WR5R...

GHSA-Q65M-PV3F-WR5R XSS in Bleach when noscript and raw tag whitelisted

Impact A mutation XSS affects users calling bleach.clean with noscript and a raw tag see below in the allowed/whitelisted tags option. Patches v3.1.1 Workarounds modify bleach.clean calls to not whitelist noscript and one or more of the following raw tags: title textarea script style noembed...

XSS in Bleach when noscript and raw tag whitelisted

Impact A mutation XSS affects users calling bleach.clean with noscript and a raw tag see below in the allowed/whitelisted tags option. Patches v3.1.1 Workarounds modify bleach.clean calls to not whitelist noscript and one or more of the following raw tags: title textarea script style noembed...

www/py-bleach -- multiple vulnerabilities

bleach.clean behavior parsing embedded MathML and SVG content with RCDATA tags did not match browser behavior and could result in a mutation XSS. Calls to bleach.clean with strip=False and math or svg tags and one or more of the RCDATA tags script, noscript, style, noframes, iframe, noembed, or x...

Cross-Site Scripting

Overview All versions of bleach are vulnerable to Cross-Site Scripting. It is possible to bypass the package's HTML sanitization with payloads such as "scriptalert'xss';script" regardless of the passed options. This may allow attackers to execute arbitrary JavaScript in the victim's browser...

py-bleach -- regular expression denial-of-service

Bleach developers reports: bleach.clean behavior parsing style attributes could result in a regular expression denial of service ReDoS. Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean..., attributes='a': 'style'...

alo7-airflow (>=1.10.0 <=1.10.0.7), cateye (>=0.3.4 <=0.3.6) +1 more potentially affected by CVE-2018-7753 via bleach (>=2.1.0 <=2.1.2)

bleach PYPI version =2.1.0, =1.10.0, =0.3.4, =0.3.6 - protobuf-compiler =1.0.20 Source cves: CVE-2018-7753 Source advisory: OSV:GHSA-M9MQ-P2F9-CFQV...

GHSA-M9MQ-P2F9-CFQV Bleach URI Scheme Restriction Bypass

An issue was discovered in Bleach 2.1.x before 2.1.3. Attributes that have URI values weren't properly sanitized if the values contained character entities. Using character entities, it was possible to construct a URI value with a scheme that was not allowed that would slide through unsanitized...