CVE-2021-28957

描述

An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS code on users who interact with incorrectly sanitized HTML. This issue is patched in lxml 4.6.3.

如何修補 CVE-2021-28957

要修補 CVE-2021-28957,請將受影響套件升級到下列已修補版本。

• —升級至 4.6.3-r0 或更新版本
• —升級至 4.6.3-1 或更新版本
• —升級至 3.7.1-1+deb9u4 或更新版本
• —升級至 4.3.2-1+deb10u3 或更新版本
• —升級至 4.6.3 或更新版本
• —升級至 a5f9cb52079dc57477c460dbe6ba0f775e14a999 或更新版本

CVE-2021-28957 正在被利用嗎?

低 — EPSS 為 4.0%,目前沒有觀察到大規模利用活動。

受影響套件(6)

• from 0, < 4.6.3-r0
• from 0, < 4.6.3-1
• from 0, < 3.7.1-1+deb9u4
• from 0, < 4.3.2-1+deb10u3
• from 0, < 4.6.3
• from 0, < a5f9cb52079dc57477c460dbe6ba0f775e14a999 | from 0, < 4.6.3

CVSS 分數

參考連結(19)

• ADVISORYgithub.com/advisories/GHSA-jq4v-f5q6-mjqq
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2021-28957
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2021-28957
• ADVISORYsecurity.alpinelinux.org/vuln/CVE-2021-28957
• PATCH