CVE-2020-6817

Impact

bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS).

Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}).

Patches

3.1.4

Workarounds

• do not whitelist the style attribute in bleach.clean calls

• limit input string length

References

• https://bugzilla.mozilla.org/show_bug.cgi?id=1623633
• https://www.regular-expressions.info/redos.html
• https://blog.r2c.dev/posts/finding-python-redos-bugs-at-scale-using-dlint-and-r2c/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6817

Credits

• Reported by schwag09 of r2c

For more information

If you have any questions or comments about this advisory:

• Open an issue at https://github.com/mozilla/bleach/issues
• Email us at [email protected]

bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}).

In Mozilla Bleach before 3.12, a mutation XSS in bleach.clean when RCDATA and either svg or math tags are whitelisted and the keyword argument strip=False. (CVE-2020-6816)

Regular expression denial of service. (CVE-2020-6817)

This update for python-bleach fixes the following issues:

• CVE-2021-23980: Fixed mutation XSS on bleach.clean with specific combinations of allowed tags (boo#1184547)

Update to 3.1.5:

• replace missing setuptools dependency with packaging. Thank you Benjamin Peterson.

Update to 3.1.4 (boo#1168280, CVE-2020-6817):

• bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute were vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}).
• Style attributes with dashes, or single or double quoted values are cleaned instead of passed through.

update to 3.1.3 (boo#1167379, CVE-2020-6816):

• Add relative link to code of conduct. (#442)
• Drop deprecated 'setup.py test' support. (#507)
• Fix typo: curren -> current in tests/test_clean.py (#504)
• Test on PyPy 7
• Drop test support for end of life Python 3.4
• bleach.clean behavior parsing embedded MathML and SVG content with RCDATA tags did not match browser behavior and could result in a mutation XSS. Calls to bleach.clean with strip=False and math or svg tags and one or more of the RCDATA tags script, noscript, style, noframes, iframe, noembed, or xmp in the allowed tags whitelist were vulnerable to a mutation XSS.

This update for python-bleach fixes the following issues:

• CVE-2021-23980: Fixed mutation XSS on bleach.clean with specific combinations of allowed tags (boo#1184547)

Update to 3.1.5:

• replace missing setuptools dependency with packaging. Thank you Benjamin Peterson.

Update to 3.1.4 (boo#1168280, CVE-2020-6817):

• bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute were vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}).
• Style attributes with dashes, or single or double quoted values are cleaned instead of passed through.

update to 3.1.3 (boo#1167379, CVE-2020-6816):

• Add relative link to code of conduct. (#442)
• Drop deprecated 'setup.py test' support. (#507)
• Fix typo: curren -> current in tests/test_clean.py (#504)
• Test on PyPy 7
• Drop test support for end of life Python 3.4
• bleach.clean behavior parsing embedded MathML and SVG content with RCDATA tags did not match browser behavior and could result in a mutation XSS. Calls to bleach.clean with strip=False and math or svg tags and one or more of the RCDATA tags script, noscript, style, noframes, iframe, noembed, or xmp in the allowed tags whitelist were vulnerable to a mutation XSS.

This update was imported from the openSUSE:Leap:15.2:Update update project.

These are all security issues fixed in the python36-bleach-3.3.0-1.4 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python310-bleach-6.1.0-1.5 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-bleach-6.4.0-1.1 package on the GA media of openSUSE Tumbleweed.

In Mozilla Bleach before 3.1.4, bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS).