Subject: bug#47319: closed (Re: bug#47319: python-lxml is vulnerable to CVE-2021-28957)

From: [email-masked] (GNU bug Tracking System)
Date: Wed, 23 Mar 2022 02:34:02 +0000

Your bug report

#47319: python-lxml is vulnerable to CVE-2021-28957

which was filed against the guix package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to [email-masked].

-- 
47319: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=47319
GNU Bug Tracking System
Contact [email-masked] with problems

Subject: Re: bug#47319: python-lxml is vulnerable to CVE-2021-28957
From: Maxim Cournoyer <[email-masked]>
To: Léo Le Bouter <[email-masked]>
Cc: [email-masked]
Date: Tue, 22 Mar 2022 22:32:52 -0400
List-Id: <debbugs-submit.debbugs.gnu.org>

Hi,

Léo Le Bouter <[email-masked]> writes:

> CVE-2021-28957	21.03.21 06:15
> lxml 4.6.2 places the HTML action attribute into defs.link_attrs (in
> html/defs.py) for later use in input sanitization, but does not do the
> same for the HTML5 formaction attribute.
>
> Upstream fixed it in 4.6.3 (
> https://github.com/lxml/lxml/commit/2d01a1ba8984e0483ce6619b972832377f208a0d
> ), so we should probably upgrade to that.

This is the current version in Guix.

Closing; thanks!

Maxim

Subject: python-lxml is vulnerable to CVE-2021-28957
From: Léo Le Bouter <[email-masked]>
To: [email-masked]
Date: Mon, 22 Mar 2021 15:09:24 +0100
List-Id: <debbugs-submit.debbugs.gnu.org>

CVE-2021-28957	21.03.21 06:15
lxml 4.6.2 places the HTML action attribute into defs.link_attrs (in
html/defs.py) for later use in input sanitization, but does not do the
same for the HTML5 formaction attribute.

Upstream fixed it in 4.6.3 (
https://github.com/lxml/lxml/commit/2d01a1ba8984e0483ce6619b972832377f208a0d
), so we should probably upgrade to that.

Has lots of dependents so I suppose it needs grafting? Is that useful
and does it work for Python packages?

Léo