GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

OPENSUSE-SU-2021:0552-1

Vulnerability from csaf_opensuse - Published: 2021-04-14 14:51 - Updated: 2021-04-14 14:51
Summary
Security update for python-bleach
Severity
Important
Notes
Title of the patch: Security update for python-bleach
Description of the patch: This update for python-bleach fixes the following issues: - CVE-2021-23980: Fixed mutation XSS on bleach.clean with specific combinations of allowed tags (boo#1184547) Update to 3.1.5: * replace missing ``setuptools`` dependency with ``packaging``. Thank you Benjamin Peterson. Update to 3.1.4 (boo#1168280, CVE-2020-6817): * ``bleach.clean`` behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to ``bleach.clean`` with an allowed tag with an allowed ``style`` attribute were vulnerable to ReDoS. For example, ``bleach.clean(..., attributes={'a': ['style']})``. * Style attributes with dashes, or single or double quoted values are cleaned instead of passed through. update to 3.1.3 (boo#1167379, CVE-2020-6816): * Add relative link to code of conduct. (#442) * Drop deprecated 'setup.py test' support. (#507) * Fix typo: curren -> current in tests/test_clean.py (#504) * Test on PyPy 7 * Drop test support for end of life Python 3.4 * ``bleach.clean`` behavior parsing embedded MathML and SVG content with RCDATA tags did not match browser behavior and could result in a mutation XSS. Calls to ``bleach.clean`` with ``strip=False`` and ``math`` or ``svg`` tags and one or more of the RCDATA tags ``script``, ``noscript``, ``style``, ``noframes``, ``iframe``, ``noembed``, or ``xmp`` in the allowed tags whitelist were vulnerable to a mutation XSS.
Patchnames: openSUSE-2021-552
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
CVE-2020-6816
6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
Product Identifier Version Remediation
Unresolved product id: openSUSE Leap 15.2:python2-bleach-3.1.5-lp152.2.3.1.noarch —
Vendor Fix
Unresolved product id: openSUSE Leap 15.2:python3-bleach-3.1.5-lp152.2.3.1.noarch —
Vendor Fix
Threats
Impact moderate
CVE-2020-6817
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Recommended 2 products, the same list as for CVE-2020-6816
Threats
Impact important
CVE-2021-23980
6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
Recommended 2 products, the same list as for CVE-2020-6816
Threats
Impact moderate
References
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for python-bleach",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for python-bleach fixes the following issues:\n\n- CVE-2021-23980: Fixed mutation XSS on bleach.clean with specific\n  combinations of allowed tags (boo#1184547)\n\nUpdate to 3.1.5:\n\n* replace missing ``setuptools`` dependency with ``packaging``. Thank you Benjamin Peterson.\n\nUpdate to 3.1.4 (boo#1168280, CVE-2020-6817):\n\n* ``bleach.clean`` behavior parsing style attributes could result in a\n  regular expression denial of service (ReDoS).\n  Calls to ``bleach.clean`` with an allowed tag with an allowed\n  ``style`` attribute were vulnerable to ReDoS. For example,\n  ``bleach.clean(..., attributes={\u0027a\u0027: [\u0027style\u0027]})``.\n* Style attributes with dashes, or single or double quoted values are\n  cleaned instead of passed through.\n\nupdate to 3.1.3 (boo#1167379, CVE-2020-6816):\n\n* Add relative link to code of conduct. (#442)\n* Drop deprecated \u0027setup.py test\u0027 support. (#507)\n* Fix typo: curren -\u003e current in tests/test_clean.py (#504)\n* Test on PyPy 7\n* Drop test support for end of life Python 3.4\n* ``bleach.clean`` behavior parsing embedded MathML and SVG content\n  with RCDATA tags did not match browser behavior and could result in\n  a mutation XSS.\n  Calls to ``bleach.clean`` with ``strip=False`` and ``math`` or\n  ``svg`` tags and one or more of the RCDATA tags ``script``,\n  ``noscript``, ``style``, ``noframes``, ``iframe``, ``noembed``, or\n  ``xmp`` in the allowed tags whitelist were vulnerable to a mutation\n  XSS.\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-2021-552",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2021_0552-1.json"
      },
      {
        "category": "self",
        "summary": "URL for openSUSE-SU-2021:0552-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YFAKMJGUZHUTZ53ZAID6PRVP5MSLXPGV/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for openSUSE-SU-2021:0552-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YFAKMJGUZHUTZ53ZAID6PRVP5MSLXPGV/"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1167379",
        "url": "https://bugzilla.suse.com/1167379"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1168280",
        "url": "https://bugzilla.suse.com/1168280"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1184547",
        "url": "https://bugzilla.suse.com/1184547"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-6816 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-6816/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-6817 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-6817/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-23980 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-23980/"
      }
    ],
    "title": "Security update for python-bleach",
    "tracking": {
      "current_release_date": "2021-04-14T14:51:29Z",
      "generator": {
        "date": "2021-04-14T14:51:29Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2021:0552-1",
      "initial_release_date": "2021-04-14T14:51:29Z",
      "revision_history": [
        {
          "date": "2021-04-14T14:51:29Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python2-bleach-3.1.5-lp152.2.3.1.noarch",
                "product": {
                  "name": "python2-bleach-3.1.5-lp152.2.3.1.noarch",
                  "product_id": "python2-bleach-3.1.5-lp152.2.3.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "python3-bleach-3.1.5-lp152.2.3.1.noarch",
                "product": {
                  "name": "python3-bleach-3.1.5-lp152.2.3.1.noarch",
                  "product_id": "python3-bleach-3.1.5-lp152.2.3.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 15.2",
                "product": {
                  "name": "openSUSE Leap 15.2",
                  "product_id": "openSUSE Leap 15.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:leap:15.2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python2-bleach-3.1.5-lp152.2.3.1.noarch as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:python2-bleach-3.1.5-lp152.2.3.1.noarch"
        },
        "product_reference": "python2-bleach-3.1.5-lp152.2.3.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-bleach-3.1.5-lp152.2.3.1.noarch as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:python3-bleach-3.1.5-lp152.2.3.1.noarch"
        },
        "product_reference": "python3-bleach-3.1.5-lp152.2.3.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2020-6816",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-6816"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In Mozilla Bleach before 3.12, a mutation XSS in bleach.clean when RCDATA and either svg or math tags are whitelisted and the keyword argument strip=False.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:python2-bleach-3.1.5-lp152.2.3.1.noarch",
          "openSUSE Leap 15.2:python3-bleach-3.1.5-lp152.2.3.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-6816",
          "url": "https://www.suse.com/security/cve/CVE-2020-6816"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1167379 for CVE-2020-6816",
          "url": "https://bugzilla.suse.com/1167379"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:python2-bleach-3.1.5-lp152.2.3.1.noarch",
            "openSUSE Leap 15.2:python3-bleach-3.1.5-lp152.2.3.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.2:python2-bleach-3.1.5-lp152.2.3.1.noarch",
            "openSUSE Leap 15.2:python3-bleach-3.1.5-lp152.2.3.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-04-14T14:51:29Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-6816"
    },
    {
      "cve": "CVE-2020-6817",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-6817"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={\u0027a\u0027: [\u0027style\u0027]}).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:python2-bleach-3.1.5-lp152.2.3.1.noarch",
          "openSUSE Leap 15.2:python3-bleach-3.1.5-lp152.2.3.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-6817",
          "url": "https://www.suse.com/security/cve/CVE-2020-6817"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1168280 for CVE-2020-6817",
          "url": "https://bugzilla.suse.com/1168280"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:python2-bleach-3.1.5-lp152.2.3.1.noarch",
            "openSUSE Leap 15.2:python3-bleach-3.1.5-lp152.2.3.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.2:python2-bleach-3.1.5-lp152.2.3.1.noarch",
            "openSUSE Leap 15.2:python3-bleach-3.1.5-lp152.2.3.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-04-14T14:51:29Z",
          "details": "important"
        }
      ],
      "title": "CVE-2020-6817"
    },
    {
      "cve": "CVE-2021-23980",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-23980"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:python2-bleach-3.1.5-lp152.2.3.1.noarch",
          "openSUSE Leap 15.2:python3-bleach-3.1.5-lp152.2.3.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-23980",
          "url": "https://www.suse.com/security/cve/CVE-2021-23980"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1184547 for CVE-2021-23980",
          "url": "https://bugzilla.suse.com/1184547"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:python2-bleach-3.1.5-lp152.2.3.1.noarch",
            "openSUSE Leap 15.2:python3-bleach-3.1.5-lp152.2.3.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.2:python2-bleach-3.1.5-lp152.2.3.1.noarch",
            "openSUSE Leap 15.2:python3-bleach-3.1.5-lp152.2.3.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-04-14T14:51:29Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2021-23980"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.