CVE-2018-19787

An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by "j a v a s c r i p t:" in Internet Explorer. This is a similar issue to CVE-2014-3146.

An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by "j a v a s c r i p t:" in Internet Explorer. This is a similar issue to CVE-2014-3146.

An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by "j a v a s c r i p t:" in Internet Explorer. This is a similar issue to CVE-2014-3146.

An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by "j a v a s c r i p t:" in Internet Explorer (CVE-2018-19787).

This update for python-lxml fixes the following issues:

• CVE-2018-19787: Fixed XSS vulnerability via unescaped URL (bsc#1118088).
• CVE-2021-28957: Fixed XSS vulnerability ia HTML5 attributes unescaped (bsc#1184177).
• CVE-2021-43818: Fixed XSS vulnerability via script content in SVG images using data URIs (bnc#1193752).
• CVE-2020-27783: Fixed mutation XSS with improper parser use (bnc#1179534).

These are all security issues fixed in the python-lxml-doc-4.9.1-4.1 package on the GA media of openSUSE Tumbleweed.

An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by "j a v a s c r i p t:" in Internet Explorer. This is a similar issue to CVE-2014-3146.

This update for python-lxml fixes the following issues:

• CVE-2018-19787: Fixed XSS vulnerability via unescaped URL (bsc#1118088).
• CVE-2021-28957: Fixed XSS vulnerability ia HTML5 attributes unescaped (bsc#1184177).
• CVE-2021-43818: Fixed XSS vulnerability via script content in SVG images using data URIs (bnc#1193752).
• CVE-2020-27783: Fixed mutation XSS with improper parser use (bnc#1179534).

This update for python-lxml fixes the following issues:

• CVE-2021-43818: Removed SVG image data URLs since they can embed script content (bsc#1193752).
• CVE-2021-28957: Fixed a potential XSS due to improper input sanitization (bsc#1184177).
• CVE-2020-27783: Fixed a potential XSS due to improper HTML parsing (bsc#1179534).
• CVE-2018-19787: Fixed a potential XSS due to improper input sanitization (bsc#1118088).

This update fixes the following issues:

venv-salt-minion:

• Fix the regression caused by the patch removing strict requirement for OpenSSL 1.1.1 leading to read/write issues with ssl module for SLE 15, SLE 12, CentOS 7, Debian 9 (bsc#1198556)
• Fixes for Python 3.10
• Fix salt-ssh opts poisoning (bsc#1197637)
• Fix multiple security issues (bsc#1197417)
  • CVE-2022-22935: Sign authentication replies to prevent MiTM
  • CVE-2022-22934: Sign pillar data to prevent MiTM attacks.
  • CVE-2022-22936: Prevent job and fileserver replays.
  • CVE-2022-22941: Fixed targeting bug, especially visible when using syndic and user auth.
• Salt version bump to 3004
• Python version bump to 3.10.2
• CVE-2022-24302: unauthorized information disclosure for python-paramiko.
• CVE-2021-28957: XSS due to missing input sanitization in python-lxml.
• CVE-2018-19787: XSS attacks due to missing URLs sanitization in python-lxml.
• Security Fix: (bsc#1196249, bsc#1196877, CVE-2022-0778)
  • Allow CRYPTO_THREADID_set_callback to be called with NULL parameter
  • Infinite loop in BN_mod_sqrt() reachable when parsing certificates

This update for ardana-barbican, grafana, openstack-barbican, openstack-cinder, openstack-heat-gbp, openstack-horizon-plugin-gbp-ui, openstack-ironic, openstack-keystone, openstack-neutron-gbp, python-lxml, release-notes-suse-openstack-cloud fixes the following issues:

Security fixes included on the update:

ardana-barbican:

• Update policies to protect container secret access (SOC-11621)
• Update policies to protect secret metadata access (SOC-11620)

openstack-neutron:

• CVE-2021-40085: Fixed arbitrary dnsmasq reconfiguration via extra_dhcp_opts (bsc#1189794).

rubygem-sinatra:

• CVE-2022-29970: Fixed path traversal possible outside of public_dir when serving static files (bsc#1199138).

python-XStatic-jquery-ui:

• CVE-2021-41182: Fixed XSS in the altField option of the Datepicker widget (bsc#1192070)
• CVE-2021-41183: Fixed XSS in the of option of the .position() util (bsc#1192073)
• CVE-2021-41184: Fixed XSS in *Text options of the Datepicker widget (bsc#1192075)

python-lxml:

• CVE-2018-19787: Fixed that the lxml.html.clean module does remove javascript in lxml/html/clean.py (bsc#1118088).
• CVE-2020-27783: Fixed mXSS due to the use of improper parser (bsc#1179534).
• CVE-2021-28957: Fixed missing input sanitization for formaction HTML5 attributes that may have led to XSS (bsc#1184177).
• CVE-2021-43818: Fixed HTML Cleaner that allowed crafted and SVG embedded scripts to pass through (bsc#1193752).

openstack-barbican:

• CVE-2022-23451: Disallows authenticated users to add/modify/delete arbitrary metadata on any secret (bsc#1194952).
• CVE-2022-23452: Disallows anyone with an admin role to add their secrets to a different project's containers (bsc#1194954).

grafana:

• CVE-2021-44716: Fixed net/http: limit growth of header canonicalization cache (bsc#1193597).

openstack-keystone:

• CVE-2021-38155: Fixed information disclosure during account locking (bsc#1189390).

Non-security fixes included on the update:

Changes in ardana-barbican:

• Update to version 9.0+git.1644879908.8a641c1:

  • Update policies to protect container secret access (SOC-11621)

• Update to version 9.0+git.1643052417.9a3348e:

  • update policies to protect secret metadata access (SOC-11620)

Changes in grafana:

• Add CVE-2021-43813.patch (bsc#1193688, CVE-2021-43813)

  • directory traversal vulnerability for .md files

• Bump Go to 1.16 (bsc#1193597, CVE-2021-44716)

  • Fix Go net/http: limit growth of header canonicalization cache

Changes in openstack-barbican:

• Add patches (0001-Fix-RBAC-and-ACL-access-for-managing-secret-containe.patch and 0001-Fix-policy-for-adding-a-secret-to-a-container.patch) to fix the legacy policy rules for adding a secret to a container and removing a secret from a container. bsc#1194954,CVE-2022-23452

• Add patch (0001-Fix-secret-metadata-access-rules.patch) to fix the legacy policy rules for accessing secret metadata by checking that the user making the request is authenticated for the project that owns the secret. bsc#1194952,CVE-2022-23451

Changes in openstack-cinder:

• Update to version cinder-13.0.10.dev24:
  • Correct group:reset_group_snapshot_status policy

Changes in openstack-cinder:

• Update to version cinder-13.0.10.dev24:
  • Correct group:reset_group_snapshot_status policy

Changes in openstack-heat-gbp:

• Update to version group-based-policy-automation-14.0.1.dev4:

  • Add support for yoga

• Update to version group-based-policy-automation-14.0.1.dev3:

  • Python2/3 compatibility fixes

• Update to version group-based-policy-automation-14.0.1.dev2:

  • Add support for xena

• Update to version group-based-policy-automation-14.0.1.dev1:

  • Remove py27 from gate jobs 14.0.0

Changes in openstack-horizon-plugin-gbp-ui:

• Update to version group-based-policy-ui-14.0.1.dev3:

  • Add support for yoga

• Update to version group-based-policy-ui-14.0.1.dev2:

  • Python2/3 compatibility changes

• Update to version group-based-policy-ui-14.0.1.dev1:

  • Add support for xena …

It was discovered that lxml incorrectly handled certain HTML files. An attacker could possibly use this issue to conduct cross-site scripting (XSS) attacks.