bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}).

This update for python-bleach fixes the following issues :

  - CVE-2021-23980: Fixed mutation XSS on bleach.clean with     specific combinations of allowed tags (boo#1184547)

Update to 3.1.5 :

  - replace missing ``setuptools`` dependency with     ``packaging``. Thank you Benjamin Peterson.

Update to 3.1.4 (boo#1168280, CVE-2020-6817) :

  - ``bleach.clean`` behavior parsing style attributes could     result in a regular expression denial of service     (ReDoS). Calls to ``bleach.clean`` with an allowed tag     with an allowed ``style`` attribute were vulnerable to     ReDoS. For example, ``bleach.clean(..., attributes=('a':
    ['style']))``.

  - Style attributes with dashes, or single or double quoted     values are cleaned instead of passed through.

update to 3.1.3 (boo#1167379, CVE-2020-6816) :

  - Add relative link to code of conduct. (#442)

  - Drop deprecated 'setup.py test' support. (#507)

  - Fix typo: curren -> current in tests/test_clean.py     (#504)

  - Test on PyPy 7

  - Drop test support for end of life Python 3.4

  - ``bleach.clean`` behavior parsing embedded MathML and     SVG content with RCDATA tags did not match browser     behavior and could result in a mutation XSS. Calls to     ``bleach.clean`` with ``strip=False`` and ``math`` or     ``svg`` tags and one or more of the RCDATA tags     ``script``, ``noscript``, ``style``, ``noframes``,     ``iframe``, ``noembed``, or ``xmp`` in the allowed tags     whitelist were vulnerable to a mutation XSS.

Update to version 3.1.4, an upstream security release. See the [upstream changelog](https://github.com/mozilla/bleach/blob/v3.1.4/CHANGES) for details.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Bleach developers reports :

bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS).

Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}).

A vulnerability was discovered in python-bleach, a whitelist-based HTML-sanitizing library. Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to a regular expression denial of service (ReDoS).

For Debian 8 'Jessie', this problem has been fixed in version 1.4-1+deb8u1.

We recommend that you upgrade your python-bleach packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
148606	openSUSE Security Update : python-bleach (openSUSE-2021-552)	Nessus	SuSE Local Security Checks	medium
136156	Fedora 31 : python-bleach (2020-e1fa96c506)	Nessus	Fedora Local Security Checks	medium
136153	Fedora 30 : python-bleach (2020-827b677e15)	Nessus	Fedora Local Security Checks	medium
136003	FreeBSD : py-bleach -- regular expression denial-of-service (4c52ec3c-86f3-11ea-b5b4-641c67a117d8)	Nessus	FreeBSD Local Security Checks	high
135102	Debian DLA-2167-1 : python-bleach security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2020-6817

high

Tenable Plugins

medium

medium

medium

high

high