Ubuntu.comUB:CVE-2024-34078CVE-2024-34078
6.1 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
6.2 Medium
AI Score
Confidence
Low
0.0004 Low
EPSS
Percentile
9.0%
html-sanitizer is an allowlist-based HTML cleaner. If using
keep_typographic_whitespace=False (which is the default), the sanitizer
normalizes unicode to the NFKC form at the end. Some unicode characters
normalize to chevrons; this allows specially crafted HTML to escape
sanitization. The problem has been fixed in 2.4.2.
Notes
| Author | Note |
|---|---|
| 0xnishit | package is FTBFS for jammy, noble |
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| ubuntu | 22.04 | noarch | python-html-sanitizer | < any | UNKNOWN |
| ubuntu | 24.04 | noarch | python-html-sanitizer | < any | UNKNOWN |
References
github.com/matthiask/html-sanitizer/commit/48db42fc5143d0140c32d929c46b802f96913550
github.com/matthiask/html-sanitizer/commit/48db42fc5143d0140c32d929c46b802f96913550 (2.4.2)
github.com/matthiask/html-sanitizer/security/advisories/GHSA-wvhx-q427-fgh3
launchpad.net/bugs/cve/CVE-2024-34078
nvd.nist.gov/vuln/detail/CVE-2024-34078
security-tracker.debian.org/tracker/CVE-2024-34078
www.cve.org/CVERecord?id=CVE-2024-34078
Related
6.1 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
6.2 Medium
AI Score
Confidence
Low
0.0004 Low
EPSS
Percentile
9.0%