Security update for python-lxml
This update for python-lxml fixes the following issues: - CVE-2021-43818: Removed SVG image data URLs since they can embed script content (bsc#1193752). - CVE-2021-28957: Fixed a potential XSS due to improper input sanitization (bsc#1184177). - CVE-2020-27783: Fixed a potential XSS due to improper HTML parsing (bsc#1179534). - CVE-2018-19787: Fixed a potential XSS due to improper input sanitization (bsc#1118088).
02 / AFFECTED SOFTWARE
Affected packages
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
This update for python-lxml fixes the following issues: - CVE-2021-43818: Removed SVG image data URLs since they can embed script content (bsc#1193752). - CVE-2021-28957: Fixed a potential XSS due to improper input sanitization (bsc#1184177). - CVE-2020-27783: Fixed a potential XSS due to improper HTML parsing (bsc#1179534). - CVE-2018-19787: Fixed a potential XSS due to improper input sanitization (bsc#1118088).
05 / REFERENCES
Further evidence
- https://bugzilla.suse.com/1118088
- https://bugzilla.suse.com/1179534
- https://bugzilla.suse.com/1184177
- https://bugzilla.suse.com/1193752
- https://www.suse.com/security/cve/CVE-2018-19787
- https://www.suse.com/security/cve/CVE-2020-27783
- https://www.suse.com/security/cve/CVE-2021-28957
- https://www.suse.com/security/cve/CVE-2021-43818
- https://www.suse.com/support/update/announcement/2022/suse-su-20220895-1/