From ddb9b76c52a043f3f133185f62c1bd44167bc271 Mon Sep 17 00:00:00 2001 From: Steve Wills Date: Fri, 27 Jul 2018 13:37:27 +0000 Subject: [PATCH] security/vuxml: document py-bleach issue PR: 226851 --- security/vuxml/vuln.xml | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 22414f433850..683d78feac79 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -58,6 +58,37 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> + + py-bleach -- unsanitized character entities + + + py27-bleach + py36-bleach + 2.1.02.1.3 + + + + +

bleach developer reports:

+
+

Attributes that have URI values weren't properly sanitized if the + values contained character entities. Using character entities, it + was possible to construct a URI value with a scheme that was not + allowed that would slide through unsanitized.

+

This security issue was introduced in Bleach 2.1. Anyone using + Bleach 2.1 is highly encouraged to upgrade.

+
+ + + + https://github.com/mozilla/bleach/blob/v2.1.3/CHANGES + + + 2018-03-05 + 2018-07-27 + + + lshell -- Shell autocomplete reveals forbidden directories