—
PYSEC-2017-14
Quick fix
PYSEC-2017-14 — html5lib: upgrade to the fixed version with the command below.
pip install --upgrade 'html5lib>=9b8d8eb5afbc066b7fac9390f5ec75e5e8a7cab7'Details
The serializer in html5lib before 0.99999999 might allow remote attackers to conduct cross-site scripting (XSS) attacks by leveraging mishandling of the < (less than) character in attribute values.
Are you affected?
Enter the version of the package you're using.
Affected packages
PyPI/html5lib
Introduced in:
0Fixed in: 9b8d8eb5afbc066b7fac9390f5ec75e5e8a7cab7Fix
pip install --upgrade 'html5lib>=9b8d8eb5afbc066b7fac9390f5ec75e5e8a7cab7'References
- https://html5lib.readthedocs.io/en/latest/changes.html#b9[WEB]
- https://github.com/html5lib/html5lib-python/issues/12[REPORT]
- https://github.com/html5lib/html5lib-python/issues/11[REPORT]
- https://github.com/html5lib/html5lib-python/commit/9b8d8eb5afbc066b7fac9390f5ec75e5e8a7cab7[FIX]
- http://www.securityfocus.com/bid/95132[WEB]
- http://www.openwall.com/lists/oss-security/2016/12/08/8[WEB]
- http://www.openwall.com/lists/oss-security/2016/12/06/5[WEB]
- https://github.com/advisories/GHSA-v9v9-xffq-rwr4[ADVISORY]