In Mozilla Bleach before 3.11, a mutation XSS affects users calling bleach.clean with noscript and a raw tag in the allowed/whitelisted tags option.

Update to version 3.1.4, an upstream security release. See the [upstream changelog](https://github.com/mozilla/bleach/blob/v3.1.4/CHANGES) for details.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for python-bleach to version 3.1.1 fixes the following issue :

  - Python-bleach was updated to 3.1.1

  - CVE-2020-6802: Fixed mutation XSS vulnerabilities     (boo#1165303).

It was reported that python-bleach, a whitelist-based HTML-sanitizing library, is prone to a mutation XSS vulnerability in bleach.clean when'noscript' and one or more raw text tags were whitelisted.

ID	Name	Product	Family	Severity
136156	Fedora 31 : python-bleach (2020-e1fa96c506)	Nessus	Fedora Local Security Checks	medium
136153	Fedora 30 : python-bleach (2020-827b677e15)	Nessus	Fedora Local Security Checks	medium
134347	openSUSE Security Update : python-bleach (openSUSE-2020-308)	Nessus	SuSE Local Security Checks	medium
134183	Debian DSA-4636-1 : python-bleach - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2020-6802

medium

Tenable Plugins

medium

medium

medium

medium