CVE-2020-27783: XSS
A Cross-site Scripting (XSS) vulnerability was found in the python-lxml's clean module. The module's parser did not properly imitate browsers, causing different behaviors between the sanitizer and the user's page. This flaw allows a remote attacker to run arbitrary HTML/JS code. The highest threat from this vulnerability is to confidentiality and integrity.
Other sources
A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behaviors between the sanitizer and the user's page. A remote attacker could exploit this flaw to run arbitrary HTML/JS code.
Python LXML is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the clean module. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
— IBM
The python-lxml package from version 1.2 and before version 4.6.2 is vulnerable to mXSS due to the use of improper parser. The parser used doesn't imitate browsers, which causes different behaviours between the sanitizer and the user's page. This can result in an arbitrary HTML/JS code execution.
References: https://pypi.org/project/lxml/4.6.1/ https://pypi.org/project/lxml/4.6.2/
Upstream patches: https://github.com/lxml/lxml/commit/89e7aad6e7ff9ecd88678ff25f885988b184b26e https://github.com/lxml/lxml/commit/a105ab8dc262ec6735977c25c13f0bdfcdec72a7
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2020-27783?
CVE-2020-27783 is a Cross-site Scripting (XSS) vulnerability found in the python-lxml's clean module.
How does CVE-2020-27783 work?
CVE-2020-27783 allows a remote attacker to run arbitrary HTML/JS code by exploiting the improper imitation of browsers in the module's parser.
What is the severity of CVE-2020-27783?
The severity of CVE-2020-27783 is medium with a CVSS score of 6.1.
Which software packages are affected by CVE-2020-27783?
The python-lxml package version 0:4.2.3-2.el8 and the following rh-python38 packages are affected: rh-python38-babel, rh-python38-python, rh-python38-python-cryptography, rh-python38-python-jinja2, rh-python38-python-lxml, rh-python38-python-pip, rh-python38-python-urllib3.
How can I fix CVE-2020-27783?
To fix CVE-2020-27783, upgrade the python-lxml package to version 4.6.2 or higher and ensure the affected rh-python38 packages are updated to the fixed versions provided by Red Hat.