#47319 python-lxml is vulnerable to CVE-2021-28957

Message #5 received at submit@debbugs.gnu.org (full text, mbox, reply):

From: Léo Le Bouter <lle-bout@zaclys.net>

To: bug-guix@gnu.org

Subject: python-lxml is vulnerable to CVE-2021-28957

Date: Mon, 22 Mar 2021 15:09:24 +0100

[Message part 1 (text/plain, inline)]

CVE-2021-28957	21.03.21 06:15
lxml 4.6.2 places the HTML action attribute into defs.link_attrs (in
html/defs.py) for later use in input sanitization, but does not do the
same for the HTML5 formaction attribute.

Upstream fixed it in 4.6.3 (
https://github.com/lxml/lxml/commit/2d01a1ba8984e0483ce6619b972832377f208a0d
), so we should probably upgrade to that.

Has lots of dependents so I suppose it needs grafting? Is that useful
and does it work for Python packages?

Léo

[signature.asc (application/pgp-signature, inline)]

Message #10 received at 47319@debbugs.gnu.org (full text, mbox, reply):

From: Léo Le Bouter <lle-bout@zaclys.net>

To: 47319@debbugs.gnu.org

Subject: Re: bug#47319: python-lxml is vulnerable to CVE-2021-28957

Date: Tue, 23 Mar 2021 16:29:42 +0100

[Message part 1 (text/plain, inline)]

I pushed a9d540cfa87ef3a5de3296188f650fb0d037efbd on core-updates, how
to fix it on master considering the amount of dependents remains to be
agreed on.

[signature.asc (application/pgp-signature, inline)]

Message #13 received at submit@debbugs.gnu.org (full text, mbox, reply):

From: Leo Famulari <leo@famulari.name>

To: Léo Le Bouter via Bug reports for GNU Guix <bug-guix@gnu.org>

Cc: 47319@debbugs.gnu.org

Subject: Re: bug#47319: python-lxml is vulnerable to CVE-2021-28957

Date: Tue, 23 Mar 2021 13:55:23 -0400

[Message part 1 (text/plain, inline)]

On Mon, Mar 22, 2021 at 03:09:24PM +0100, Léo Le Bouter via Bug reports for GNU Guix wrote:
> CVE-2021-28957	21.03.21 06:15
> lxml 4.6.2 places the HTML action attribute into defs.link_attrs (in
> html/defs.py) for later use in input sanitization, but does not do the
> same for the HTML5 formaction attribute.

Thanks for the notification.

I checked on some other distros that, like us, try to avoid major
updates of packages with a lot of dependents:

https://security-tracker.debian.org/tracker/CVE-2021-28957
https://access.redhat.com/security/cve/cve-2021-28957

So, both Debian and Red Hat are still shipping the vulnerable packages.
At least, we are in good company. We would monitor the Debian page and
copy their patch, if they decide to fix the bug.

> Upstream fixed it in 4.6.3 (
> https://github.com/lxml/lxml/commit/2d01a1ba8984e0483ce6619b972832377f208a0d
> ), so we should probably upgrade to that.
> 
> Has lots of dependents so I suppose it needs grafting? Is that useful
> and does it work for Python packages?

Grafting Python packages is not something we've done in the past, as far
as I can tell from reading the Git log, although I don't recall know if
it works or not.

[signature.asc (application/pgp-signature, inline)]

Message #19 received at 47319@debbugs.gnu.org (full text, mbox, reply):

From: Mark H Weaver <mhw@netris.org>

To: Leo Famulari <leo@famulari.name>, 47319@debbugs.gnu.org

Subject: Re: bug#47319: python-lxml is vulnerable to CVE-2021-28957

Date: Mon, 05 Apr 2021 19:54:54 -0400

Leo Famulari <leo@famulari.name> writes:

> On Mon, Mar 22, 2021 at 03:09:24PM +0100, Léo Le Bouter via Bug reports for GNU Guix wrote:
>> Has lots of dependents so I suppose it needs grafting? Is that useful
>> and does it work for Python packages?
>
> Grafting Python packages is not something we've done in the past, as far
> as I can tell from reading the Git log, although I don't recall know if
> it works or not.

I see no reason why grafting a python package wouldn't work, although
admittedly my knowledge of Python is weak.

      Mark

Message #24 received at 47319-done@debbugs.gnu.org (full text, mbox, reply):

From: Maxim Cournoyer <maxim.cournoyer@gmail.com>

To: Léo Le Bouter <lle-bout@zaclys.net>

Cc: 47319-done@debbugs.gnu.org

Subject: Re: bug#47319: python-lxml is vulnerable to CVE-2021-28957

Date: Tue, 22 Mar 2022 22:32:52 -0400

Hi,

Léo Le Bouter <lle-bout@zaclys.net> writes:

> CVE-2021-28957	21.03.21 06:15
> lxml 4.6.2 places the HTML action attribute into defs.link_attrs (in
> html/defs.py) for later use in input sanitization, but does not do the
> same for the HTML5 formaction attribute.
>
> Upstream fixed it in 4.6.3 (
> https://github.com/lxml/lxml/commit/2d01a1ba8984e0483ce6619b972832377f208a0d
> ), so we should probably upgrade to that.

This is the current version in Guix.

Closing; thanks!

Maxim

Send a report that this bug log contains spam.