mirror/freebsd-ports
1
0
Fork 0
mirror of https://git.FreeBSD.org/ports.git synced 2025-02-03 11:12:13 +00:00
Code Issues Releases Activity

security/vuxml: Add www/py-bleach entry

Browse Source
This commit is contained in:
Kubilay Kocak 2020-03-18 07:23:22 +00:00
parent 32aaae4447
commit 14aaafe46e
Notes: svn2git 2021-03-31 03:12:20 +00:00 
svn path=/head/; revision=528629
1 changed files with 46 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

46
security/vuxml/vuln.xml
View File

@ -58,6 +58,52 @@ Notes:
* Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
<vuln vid="3d19c776-68e7-11ea-91db-0050562a4d7b">
<topic>www/py-bleach -- multiple vulnerabilities</topic>
<affects>
<package>
<name>py27-bleach</name>
<name>py35-bleach</name>
<name>py36-bleach</name>
<name>py37-bleach</name>
<name>py38-bleach</name>
<range><lt>3.1.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<blockquote>
<p>* ``bleach.clean`` behavior parsing embedded MathML and SVG content
with RCDATA tags did not match browser behavior and could result in
a mutation XSS.
</p>
<p> Calls to ``bleach.clean`` with ``strip=False`` and ``math`` or
``svg`` tags and one or more of the RCDATA tags ``script``,
``noscript``, ``style``, ``noframes``, ``iframe``, ``noembed``, or
``xmp`` in the allowed tags whitelist were vulnerable to a mutation
XSS.
</p>
<p>* ``bleach.clean`` behavior parsing ``noscript`` tags did not match
browser behavior.
</p>
<p> Calls to ``bleach.clean`` allowing ``noscript`` and one or more of
the raw text tags (``title``, ``textarea``, ``script``, ``style``,
``noembed``, ``noframes``, ``iframe``, and ``xmp``) were vulnerable
to a mutation XSS.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=1615315</url>
<url>https://bugzilla.mozilla.org/show_bug.cgi?id=1621692</url>
</references>
<dates>
<discovery>2020-02-13</discovery>
<entry>2020-03-18</entry>
</dates>
</vuln>
<vuln vid="4ae135f7-85cd-4c32-ad94-358271b31f7f">
<topic>zeek -- potential denial of service issues</topic>
<affects>