CVE-2021-28957
Description
RHSA-2021:4162: python38:3.8 and python38-devel:3.8 security update (Moderate)
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Mitigation details
Description python-lxml: Missing input sanitization for formaction HTML5 attributes may lead to XSS Red Hat statement Web applications vulnerable to this flaw, where a XSS attack can be accomplished, are only those that use python-lxml to sanitize HTML input and that allow user data to be placed in the "formaction" attribute of a form button. In Red Hat OpenStack Platform, because the flaw has a…
Description
python-lxml: Missing input sanitization for formaction HTML5 attributes may lead to XSS
Red Hat statement
Web applications vulnerable to this flaw, where a XSS attack can be accomplished, are only those that use python-lxml to sanitize HTML input and that allow user data to be placed in the "formaction" attribute of a form button. In Red Hat OpenStack Platform, because the flaw has a lower impact and the package is unlikely to be exploited in the RHOSP environment, no update will be provided at this time for the RHOSP python-lxml package. For Ansible Tower and Ansible Automation Platform, Lowering the impact from Moderate to Low as the vulnerable function i.e. lxml HTML Cleaner and the vulnerable attribute i.e. HTML FormAction are not being used.
CVSS v3: 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Errata / fixed releases
| Product | Package | Advisory | Released |
|---|---|---|---|
| Red Hat Enterprise Linux 8 | python27:2.7-8050020210811095446.3e7ace8b | RHSA-2021:4151 | 2021-11-09T00:00:00Z |
| Red Hat Enterprise Linux 8 | python-lxml-0:4.2.3-3.el8 | RHSA-2021:4158 | 2021-11-09T00:00:00Z |
| Red Hat Enterprise Linux 8 | python39:3.9-8050020210811100211.d428a79b | RHSA-2021:4160 | 2021-11-09T00:00:00Z |
| Red Hat Enterprise Linux 8 | python39-devel:3.9-8050020210811100211.d428a79b | RHSA-2021:4160 | 2021-11-09T00:00:00Z |
| Red Hat Enterprise Linux 8 | python38:3.8-8050020210811101222.e3d35cca | RHSA-2021:4162 | 2021-11-09T00:00:00Z |
| Red Hat Enterprise Linux 8 | python38-devel:3.8-8050020210811101222.e3d35cca | RHSA-2021:4162 | 2021-11-09T00:00:00Z |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | rh-python38-babel-0:2.7.0-12.el7 | RHSA-2021:3254 | 2021-08-24T00:00:00Z |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | rh-python38-python-0:3.8.11-2.el7 | RHSA-2021:3254 | 2021-08-24T00:00:00Z |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | rh-python38-python-cryptography-0:2.8-5.el7 | RHSA-2021:3254 | 2021-08-24T00:00:00Z |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | rh-python38-python-jinja2-0:2.10.3-6.el7 | RHSA-2021:3254 | 2021-08-24T00:00:00Z |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | rh-python38-python-lxml-0:4.4.1-7.el7 | RHSA-2021:3254 | 2021-08-24T00:00:00Z |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | rh-python38-python-pip-0:19.3.1-2.el7 | RHSA-2021:3254 | 2021-08-24T00:00:00Z |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | rh-python38-python-urllib3-0:1.25.7-7.el7 | RHSA-2021:3254 | 2021-08-24T00:00:00Z |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS | rh-python38-babel-0:2.7.0-12.el7 | RHSA-2021:3254 | 2021-08-24T00:00:00Z |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS | rh-python38-python-0:3.8.11-2.el7 | RHSA-2021:3254 | 2021-08-24T00:00:00Z |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS | rh-python38-python-cryptography-0:2.8-5.el7 | RHSA-2021:3254 | 2021-08-24T00:00:00Z |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS | rh-python38-python-jinja2-0:2.10.3-6.el7 | RHSA-2021:3254 | 2021-08-24T00:00:00Z |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS | rh-python38-python-lxml-0:4.4.1-7.el7 | RHSA-2021:3254 | 2021-08-24T00:00:00Z |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS | rh-python38-python-pip-0:19.3.1-2.el7 | RHSA-2021:3254 | 2021-08-24T00:00:00Z |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS | rh-python38-python-urllib3-0:1.25.7-7.el7 | RHSA-2021:3254 | 2021-08-24T00:00:00Z |
Package state
| Product | Package | State |
|---|---|---|
| Red Hat Ansible Automation Platform 1.2 | lxml | Affected |
| Red Hat Ansible Tower 3 | lxml | Out of support scope |
| Red Hat Enterprise Linux 6 | python-lxml | Out of support scope |
| Red Hat Enterprise Linux 7 | python-lxml | Out of support scope |
| Red Hat Enterprise Linux 9 | python-lxml | Not affected |
| Red Hat OpenStack Platform 10 (Newton) | python-lxml | Out of support scope |
| Red Hat OpenStack Platform 13 (Queens) | python-lxml | Will not fix |
Apply commands
yum update -y python27:2
# or:
dnf upgrade -y python27:2Affected
| Vendor | Product | Version |
|---|---|---|
| redhat | Red Hat Ansible Automation Platform 1.2 | Affected |
| redhat | Red Hat Enterprise Linux 9 | Not affected |
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| arch | fixed | 4.6.3-1 | |
| sles | affected | | |
| rocky | 8 | fixed | |
| debian | bookworm | fixed | 4.6.3-1 |
| debian | bullseye | fixed | 4.6.3-1 |
| debian | forky | fixed | 4.6.3-1 |
| debian | sid | fixed | 4.6.3-1 |
| debian | trixie | fixed | 4.6.3-1 |
| rhel | 8 | fixed | |
References
- https://nvd.nist.gov/vuln/detail/CVE-2021-28957
- https://github.com/lxml/lxml/pull/316
- https://github.com/lxml/lxml/pull/316/commits/10ec1b4e9f93713513a3264ed6158af22492f270
- https://github.com/lxml/lxml/commit/2d01a1ba8984e0483ce6619b972832377f208a0d
- https://github.com/lxml/lxml/commit/a5f9cb52079dc57477c460dbe6ba0f775e14a999
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://www.debian.org/security/2021/dsa-4880
- https://security.netapp.com/advisory/ntap-20210521-0004
- https://security.gentoo.org/glsa/202208-06
- https://pypi.org/project/lxml
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XXN3QPWCTQVOGW4BMWV3AUUZZ4NRZNSQ
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3C2R44VDUY7FJVMAVRZ2WY7XYL4SVN45
- https://lists.debian.org/debian-lts-announce/2021/03/msg00031.html
- https://github.com/pypa/advisory-database/tree/main/vulns/lxml/PYSEC-2021-19.yaml
- https://github.com/lxml/lxml
- https://github.com/advisories/GHSA-jq4v-f5q6-mjqq
- https://bugs.launchpad.net/lxml/+bug/1888153
- https://www.suse.com/security/cve/CVE-2021-28957.html
- https://errata.rockylinux.org/RLSA-2021:4162
- https://errata.rockylinux.org/RLSA-2021:4160
- https://errata.rockylinux.org/RLSA-2021:4158
- https://errata.rockylinux.org/RLSA-2021:4151
- https://security-tracker.debian.org/tracker/CVE-2021-28957
- https://errata.almalinux.org/8/ALSA-2021-4160.html
- https://errata.almalinux.org/8/ALSA-2021-4158.html
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.