CVE-2021-23980
Published: 16 February 2023
A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.
Priority
Status
Package | Release | Status |
---|---|---|
python-bleach Launchpad, Ubuntu, Debian |
jammy |
Needs triage
|
kinetic |
Ignored
(end of life, was needs-triage)
|
|
bionic |
Needs triage
|
|
focal |
Needs triage
|
|
groovy |
Ignored
(end of life)
|
|
hirsute |
Ignored
(end of life)
|
|
trusty |
Does not exist
|
|
upstream |
Needs triage
|
|
impish |
Ignored
(end of life)
|
|
xenial |
Needs triage
|
|
mantic |
Needs triage
|
|
lunar |
Ignored
(end of life, was needs-triage)
|
Severity score breakdown
Parameter | Value |
---|---|
Base score | 6.1 |
Attack vector | Network |
Attack complexity | Low |
Privileges required | None |
User interaction | Required |
Scope | Changed |
Confidentiality | Low |
Integrity impact | Low |
Availability impact | None |
Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
References
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23980
- https://github.com/mozilla/bleach/security/advisories/GHSA-vv2x-vrpj-qqpq
- https://bugzilla.mozilla.org/show_bug.cgi?id=1689399
- https://github.com/mozilla/bleach/commit/79b7a3c5e56a09d1d323a5006afa59b56162eb13
- https://github.com/mozilla/bleach/commit/d398c89e54ced6b1039d3677689707456ba42dec
- NVD
- Launchpad
- Debian