CVE-2021-23980

A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.

Impact

A mutation XSS affects users calling bleach.clean with all of:

• svg or math in the allowed tags
• p or br in allowed tags
• style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags
• the keyword argument strip_comments=False

Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.

Patches

Users are encouraged to upgrade to bleach v3.3.0 or greater.

Note: bleach v3.3.0 introduces a breaking change to escape HTML comments by default.

Workarounds

• modify bleach.clean calls to at least one of:

  • not allow the style, title, noscript, script, textarea, noframes, iframe, or xmp tag
  • not allow svg or math tags
  • not allow p or br tags
  • set strip_comments=True

• A strong Content-Security-Policy without unsafe-inline and unsafe-eval script-srcs) will also help mitigate the risk.

References

• https://bugzilla.mozilla.org/show_bug.cgi?id=1689399
• https://advisory.checkmarx.net/advisory/CX-2021-4303
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23980
• https://cure53.de/fp170.pdf

Credits

• Reported by Yaniv Nizry from the CxSCA AppSec group at Checkmarx
• Additional eject tags not mentioned in the original advisory and the CSP mitigation line being truncated in the revised advisory reported by Michał Bentkowski at Securitum

For more information

If you have any questions or comments about this advisory:

• Open an issue at https://github.com/mozilla/bleach/issues
• Email us at [email protected]

Bleach is an HTML sanitizing library that escapes or strips markup and attributes based on a white list.

Security Fix(es):

No description is available for this CVE.(CVE-2021-23980)

A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.

It was reported that python-bleach, a whitelist-based HTML-sanitizing library, is prone to a mutation XSS vulnerability in bleach.clean when "svg" or "math" are in the allowed tags, 'p' or "br" are in allowed tags, "style", "title", "noscript", "script", "textarea", "noframes", "iframe", or "xmp" are in allowed tags and 'strip_comments=False' is set (CVE-2021-23980).

This update for python-bleach fixes the following issues:

• CVE-2021-23980: Fixed mutation XSS on bleach.clean with specific combinations of allowed tags (boo#1184547)

Update to 3.1.5:

• replace missing setuptools dependency with packaging. Thank you Benjamin Peterson.

Update to 3.1.4 (boo#1168280, CVE-2020-6817):

• bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute were vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}).
• Style attributes with dashes, or single or double quoted values are cleaned instead of passed through.

update to 3.1.3 (boo#1167379, CVE-2020-6816):

• Add relative link to code of conduct. (#442)
• Drop deprecated 'setup.py test' support. (#507)
• Fix typo: curren -> current in tests/test_clean.py (#504)
• Test on PyPy 7
• Drop test support for end of life Python 3.4
• bleach.clean behavior parsing embedded MathML and SVG content with RCDATA tags did not match browser behavior and could result in a mutation XSS. Calls to bleach.clean with strip=False and math or svg tags and one or more of the RCDATA tags script, noscript, style, noframes, iframe, noembed, or xmp in the allowed tags whitelist were vulnerable to a mutation XSS.

This update for python-bleach fixes the following issues:

• CVE-2021-23980: Fixed mutation XSS on bleach.clean with specific combinations of allowed tags (boo#1184547)

Update to 3.1.5:

• replace missing setuptools dependency with packaging. Thank you Benjamin Peterson.

Update to 3.1.4 (boo#1168280, CVE-2020-6817):

• bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute were vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}).
• Style attributes with dashes, or single or double quoted values are cleaned instead of passed through.

update to 3.1.3 (boo#1167379, CVE-2020-6816):

• Add relative link to code of conduct. (#442)
• Drop deprecated 'setup.py test' support. (#507)
• Fix typo: curren -> current in tests/test_clean.py (#504)
• Test on PyPy 7
• Drop test support for end of life Python 3.4
• bleach.clean behavior parsing embedded MathML and SVG content with RCDATA tags did not match browser behavior and could result in a mutation XSS. Calls to bleach.clean with strip=False and math or svg tags and one or more of the RCDATA tags script, noscript, style, noframes, iframe, noembed, or xmp in the allowed tags whitelist were vulnerable to a mutation XSS.

This update was imported from the openSUSE:Leap:15.2:Update update project.

These are all security issues fixed in the python36-bleach-3.3.0-1.4 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python310-bleach-6.1.0-1.5 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-bleach-6.4.0-1.1 package on the GA media of openSUSE Tumbleweed.

In Mozilla Bleach before 3.3.0, a mutation XSS affects users calling bleach.clean with math or svg; p or br; and style, title, noscript, script, textarea, noframes, iframe, or xmp tags with strip_comments=False.