—

PYSEC-2020-62

Quick fix

PYSEC-2020-62 — lxml: upgrade to the fixed version with the command below.

pip install --upgrade 'lxml>=4.6.2'

Details

A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behaviors between the sanitizer and the user's page. A remote attacker could exploit this flaw to run arbitrary HTML/JS code.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/lxml

Introduced in: 1.2Fixed in: 4.6.2

Fixpip install --upgrade 'lxml>=4.6.2'

References

https://bugzilla.redhat.com/show_bug.cgi?id=1901633[REPORT]
https://www.debian.org/security/2020/dsa-4810[ADVISORY]
https://lists.debian.org/debian-lts-announce/2020/12/msg00028.html[WEB]
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JKG67GPGTV23KADT4D4GK4RMHSO4CIQL/[WEB]
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TMHVKRUT22LVWNL3TB7HPSDHJT74Q3JK/[WEB]
https://advisory.checkmarx.net/advisory/CX-2020-4286[ADVISORY]
https://github.com/advisories/GHSA-pgww-xf46-h92r[ADVISORY]