Huawei EulerOS: Security Advisory for python-lxml (EulerOS-SA-2021-1016)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

doc2dash (1.2.0) potentially affected by CVE-2020-27783 via lxml (3.2.3)

lxml PYPI version 3.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - doc2dash 1.2.0 Source cves: CVE-2020-27783 Source advisory: OSV:GHSA-PGWW-XF46-H92R...

allen-bradley-toolkit (>=1.0.0a1.post0, <=1.3.0a1.post1), coala-bears (>=0.12.0.dev20170531025553, <=0.12.0.dev20170719125022) +10 more potentially affected by CVE-2020-27783 via lxml (3.6.0)

lxml PYPI version 3.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - allen-bradley-toolkit =1.0.0a1.post0, =0.12.0.dev20170531025553, =0.0.0, =0.18.1, =0.9.0, =0.6.3, =4.0.0, =4.3.0 - tml 0.3.1 Source cves: CVE-2020-27783...

rymtracks (0.1.2) potentially affected by CVE-2020-27783 via lxml (3.3.0)

lxml PYPI version 3.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - rymtracks 0.1.2 Source cves: CVE-2020-27783 Source advisory: OSV:GHSA-PGWW-XF46-H92R...

adamalib (0.1.0), bormeparser (>=0.1.1, <=0.2.3) +23 more potentially affected by CVE-2020-27783 via lxml (3.4.4)

lxml PYPI version 3.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - adamalib 0.1.0 - bormeparser =0.1.1, =2.0.1.16012810, =2.0.1.16012810, =2.0.1.16012810, =1.0.1, =2.0.2.16012810, =2.0.1.15101417, =2.0.1.15101417,...

bioc (>=1.1.0.dev1, <=1.1.0.dev2), biweeklybudget (>=0.1.0, <=0.7.0) +13 more potentially affected by CVE-2020-27783 via lxml (3.7.3)

lxml PYPI version 3.7.3 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - bioc =1.1.0.dev1, =0.1.0, =0.3.3, =1.1.3.0, =0.6.14, =1.0.0, =0.1.4, =0.1.5 - pyodata 1.1.1 - readembedability 1.6.0 - sfmc 0.1.2 - sirbot-plugins 0.1.2...

beu (>=0.1.0, <=0.1.1), c2cwsgiutils (>=0.2.0, <=0.3.2) +3 more potentially affected by CVE-2020-27783 via lxml (3.7.2)

lxml PYPI version 3.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - beu =0.1.0, =0.2.0, =0.1.0, =0.1.1, =0.1.3 Source cves: CVE-2020-27783 Source advisory: OSV:GHSA-PGWW-XF46-H92R...

appngizer (>=1.14.1, <=1.15.0), qixnat (>=2.1.2, <=2.1.3) +1 more potentially affected by CVE-2020-27783 via lxml (3.4.0)

lxml PYPI version 3.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - appngizer =1.14.1, =2.1.2, =0.1.0, =0.2.5 Source cves: CVE-2020-27783 Source advisory: OSV:GHSA-PGWW-XF46-H92R...

chopper (>=0.4.7, <=0.4.8), doc2dash (>=1.2.1, <=2.0.2) potentially affected by CVE-2020-27783 via lxml (3.3.5)

lxml PYPI version 3.3.5 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - chopper =0.4.7, =1.2.1, =2.0.2 Source cves: CVE-2020-27783 Source advisory: OSV:GHSA-PGWW-XF46-H92R...

bormeparser (0.2.4), bsxprinter (>=0.2.0, <=0.4.0) +16 more potentially affected by CVE-2020-27783 via lxml (3.6.4)

lxml PYPI version 3.6.4 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - bormeparser 0.2.4 - bsxprinter =0.2.0, =0.1.0, =0.1.1, =0.6.12a2, =1.5.9, =0.1.1, =0.1.3 and more Source cves: CVE-2020-27783 Source advisory:...

a3m (0.1.0), acdh-collatex-utils (>=0.2.0, <=1.2.0) +404 more potentially affected by CVE-2020-27783 via lxml (>=4.0.0, <=4.6.1)

lxml PYPI version =4.0.0, =0.2.0, =1.0.0rc1, =3.0.0, =0.1.0, =0.1.16, =0.7.2, =1.0.1, =1.1.15, =0.0.5.dev412, =4.0.0, =0.39.0, =0.42.0 and more Source cves: CVE-2020-27783 Source advisory: OSV:GHSA-PGWW-XF46-H92R...

a3m (0.1.0), acdh-collatex-utils (>=0.2.0, <=1.2.0) +404 more potentially affected by CVE-2020-27783 via lxml (>=4.0.0, <=4.6.1)

lxml PYPI version =4.0.0, =0.2.0, =1.0.0rc1, =3.0.0, =0.1.0, =0.1.16, =0.7.2, =1.0.1, =1.1.15, =0.0.5.dev412, =4.0.0, =0.39.0, =0.42.0 and more Source cves: CVE-2020-27783 Source advisory: GHSA-PGWW-XF46-H92R...

lxml vulnerable to Cross-site Scripting

A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behaviors between the sanitizer and the user's page. A remote attacker could exploit this flaw to run arbitrary HTML/JS code...

GHSA-PGWW-XF46-H92R lxml vulnerable to Cross-site Scripting

A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behaviors between the sanitizer and the user's page. A remote attacker could exploit this flaw to run arbitrary HTML/JS code...

eemeter (>=0.4.9, <=0.5.11), nginxauthdaemon (>=1.0.0a1, <=1.1.0) +1 more potentially affected by CVE-2020-27783 via lxml (3.6.1)

lxml PYPI version 3.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - eemeter =0.4.9, =1.0.0a1, =1.1.0 - rrtop100 0.1.0 Source cves: CVE-2020-27783 Source advisory: OSV:GHSA-PGWW-XF46-H92R...

reahl-webdev (>=3.1.0, <=3.2.0) potentially affected by CVE-2020-27783 via lxml (3.3.6)

lxml PYPI version 3.3.6 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - reahl-webdev =3.1.0, =3.2.0 Source cves: CVE-2020-27783 Source advisory: OSV:GHSA-PGWW-XF46-H92R...

django-transcribe (>=0.3.5, <=0.5.17), odooku-odoo-account-invoicing (>=11.0.0, <=11.0.6) +35 more potentially affected by CVE-2020-27783 via lxml (3.5.0)

lxml PYPI version 3.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - django-transcribe =0.3.5, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0,...

document-clipper (>=0.9.0, <=0.13.6) potentially affected by CVE-2020-27783 via lxml (3.3.2)

lxml PYPI version 3.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - document-clipper =0.9.0, =0.13.6 Source cves: CVE-2020-27783 Source advisory: OSV:GHSA-PGWW-XF46-H92R...

no-cloud (0.0.8), okami (0.1.0) potentially affected by CVE-2020-27783 via lxml (3.7.1)

lxml PYPI version 3.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - no-cloud 0.0.8 - okami 0.1.0 Source cves: CVE-2020-27783 Source advisory: OSV:GHSA-PGWW-XF46-H92R...

epcpyyes (>=1.0.13, <=1.2.0) potentially affected by CVE-2020-27783 via lxml (3.7.0)

lxml PYPI version 3.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - epcpyyes =1.0.13, =1.2.0 Source cves: CVE-2020-27783 Source advisory: OSV:GHSA-PGWW-XF46-H92R...