[SECURITY] [DLA 1604-1] lxml security update

Package : lxml Version : 3.4.0-1+deb8u1 CVE ID : CVE-2018-19787 It was discovered that there was a XSS injection vulnerability in the LXML HTML/XSS manipulation library for Python. LXML did not remove "javascript:" URLs that used escaping such as "j a v a s c r i p t". This is a similar issue to...

Debian: Security Advisory (DLA-1604-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

DLA-1604-1 lxml - security update

Bulletin has no description...

CVE-2018-19787

An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by "j a v a s c r i p t:" in Internet Explorer. This is a similar issue to...

appngizer (>=1.14.1, <=1.15.0), qixnat (>=2.1.2, <=2.1.3) +1 more potentially affected by CVE-2014-3146 +1 more via lxml (3.4.0)

lxml PYPI version 3.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - appngizer =1.14.1, =2.1.2, =0.1.0, =0.2.5 Source cves: CVE-2014-3146, CVE-2018-19787 Source advisory: OSV:PYSEC-2018-12...

bioc (>=1.1.0.dev1, <=1.1.0.dev2), biweeklybudget (>=0.1.0, <=0.7.0) +13 more potentially affected by CVE-2014-3146 +1 more via lxml (3.7.3)

lxml PYPI version 3.7.3 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - bioc =1.1.0.dev1, =0.1.0, =0.3.3, =1.1.3.0, =0.6.14, =1.0.0, =0.1.4, =0.1.5 - pyodata 1.1.1 - readembedability 1.6.0 - sfmc 0.1.2 - sirbot-plugins 0.1.2...

no-cloud (0.0.8), okami (0.1.0) potentially affected by CVE-2014-3146 +1 more via lxml (3.7.1)

lxml PYPI version 3.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - no-cloud 0.0.8 - okami 0.1.0 Source cves: CVE-2014-3146, CVE-2018-19787 Source advisory: OSV:PYSEC-2018-12...

PYSEC-2018-12

An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by "j a v a s c r i p t:" in Internet Explorer. This is a similar issue to...

alo7-airflow (>=1.10.0, <=1.10.0.7), c2cwsgiutils (>=0.14.0, <=0.27.0) +44 more potentially affected by CVE-2014-3146 +1 more via lxml (3.8.0)

lxml PYPI version 3.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - alo7-airflow =1.10.0, =0.14.0, =0.0.1, =0.2.2, =1.0.0, =3.0.4, =0.0.0a3, =0.8.4, =0.1.4, =0.0.13, =0.0.0, =0.0.2, =1.0.0a2, =1.0.0a8 and more Source cve...

AZL-6806 CVE-2018-19787 affecting package python-lxml for versions less than 4.8.0-1

An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by "j a v a s c r i p t:" in Internet Explorer. This is a similar issue to...

PYSEC-2018-12

An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by "j a v a s c r i p t:" in Internet Explorer. This is a similar issue to...

doc2dash (1.2.0) potentially affected by CVE-2014-3146 +1 more via lxml (3.2.3)

lxml PYPI version 3.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - doc2dash 1.2.0 Source cves: CVE-2014-3146, CVE-2018-19787 Source advisory: OSV:PYSEC-2018-12...

reahl-webdev (>=3.1.0, <=3.2.0) potentially affected by CVE-2014-3146 +1 more via lxml (3.3.6)

lxml PYPI version 3.3.6 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - reahl-webdev =3.1.0, =3.2.0 Source cves: CVE-2014-3146, CVE-2018-19787 Source advisory: OSV:PYSEC-2018-12...

rymtracks (0.1.2) potentially affected by CVE-2014-3146 +1 more via lxml (3.3.0)

lxml PYPI version 3.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - rymtracks 0.1.2 Source cves: CVE-2014-3146, CVE-2018-19787 Source advisory: OSV:PYSEC-2018-12...

chopper (>=0.4.7, <=0.4.8), doc2dash (>=1.2.1, <=2.0.2) potentially affected by CVE-2014-3146 +1 more via lxml (3.3.5)

lxml PYPI version 3.3.5 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - chopper =0.4.7, =1.2.1, =2.0.2 Source cves: CVE-2014-3146, CVE-2018-19787 Source advisory: OSV:PYSEC-2018-12...

adamalib (0.1.0), bormeparser (>=0.1.1, <=0.2.3) +23 more potentially affected by CVE-2014-3146 +1 more via lxml (3.4.4)

lxml PYPI version 3.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - adamalib 0.1.0 - bormeparser =0.1.1, =2.0.1.16012810, =2.0.1.16012810, =2.0.1.16012810, =1.0.1, =2.0.2.16012810, =2.0.1.15101417, =2.0.1.15101417,...

elifearticle (0.1.1), elifedbtools (0.0.1) +1 more potentially affected by CVE-2014-3146 +1 more via lxml (3.4.1)

lxml PYPI version 3.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - elifearticle 0.1.1 - elifedbtools 0.0.1 - elifetools =0.1.2, =0.1.7 Source cves: CVE-2014-3146, CVE-2018-19787 Source advisory: OSV:PYSEC-2018-12...

allen-bradley-toolkit (>=1.0.0a1.post0, <=1.3.0a1.post1), coala-bears (>=0.12.0.dev20170531025553, <=0.12.0.dev20170719125022) +10 more potentially affected by CVE-2014-3146 +1 more via lxml (3.6.0)

lxml PYPI version 3.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - allen-bradley-toolkit =1.0.0a1.post0, =0.12.0.dev20170531025553, =0.0.0, =0.18.1, =0.9.0, =0.6.3, =4.0.0, =4.3.0 - tml 0.3.1 Source cves: CVE-2014-3146,...

Design/Logic Flaw

An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by "j a v a s c r i p t:" in Internet Explorer. This is a similar issue to...

beu (>=0.1.0, <=0.1.1), c2cwsgiutils (>=0.2.0, <=0.3.2) +3 more potentially affected by CVE-2014-3146 +1 more via lxml (3.7.2)

lxml PYPI version 3.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - beu =0.1.0, =0.2.0, =0.1.0, =0.1.1, =0.1.3 Source cves: CVE-2014-3146, CVE-2018-19787 Source advisory: OSV:PYSEC-2018-12...