1. Home
  2. Security Advisories
  3. Amazon Linux
  4. ALAS2-2024-2620

[ALAS2-2024-2620] Amazon Linux 2 2017.12 - ALAS2-2024-2620: medium priority package update for python-lxml

Severity Medium
Affected Packages 10
CVEs 1
Info Packages References Vulnerabilities

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities:
CVE-2021-28957:
An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS code on users who interact with incorrectly sanitized HTML. This issue is patched in lxml 4.6.3.

Package Affected Version
pkg:rpm/amazonlinux/python3-lxml?arch=x86_64&distro=amazonlinux-2 < 3.2.1-4.amzn2.0.6
pkg:rpm/amazonlinux/python3-lxml?arch=i686&distro=amazonlinux-2 < 3.2.1-4.amzn2.0.6
pkg:rpm/amazonlinux/python3-lxml?arch=aarch64&distro=amazonlinux-2 < 3.2.1-4.amzn2.0.6
pkg:rpm/amazonlinux/python-lxml?arch=x86_64&distro=amazonlinux-2 < 3.2.1-4.amzn2.0.6
pkg:rpm/amazonlinux/python-lxml?arch=i686&distro=amazonlinux-2 < 3.2.1-4.amzn2.0.6
pkg:rpm/amazonlinux/python-lxml?arch=aarch64&distro=amazonlinux-2 < 3.2.1-4.amzn2.0.6
pkg:rpm/amazonlinux/python-lxml-docs?arch=noarch&distro=amazonlinux-2 < 3.2.1-4.amzn2.0.6
pkg:rpm/amazonlinux/python-lxml-debuginfo?arch=x86_64&distro=amazonlinux-2 < 3.2.1-4.amzn2.0.6
pkg:rpm/amazonlinux/python-lxml-debuginfo?arch=i686&distro=amazonlinux-2 < 3.2.1-4.amzn2.0.6
pkg:rpm/amazonlinux/python-lxml-debuginfo?arch=aarch64&distro=amazonlinux-2 < 3.2.1-4.amzn2.0.6
ID
ALAS2-2024-2620
Severity
medium
URL
https://alas.aws.amazon.com/AL2/ALAS-2024-2620.html
Published
2024-08-01T03:01:00
(6 weeks ago)
Modified
2024-08-01T03:01:00
(6 weeks ago)
Rights
Amazon Linux Security Team
Other Advisories
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Affected pkg:rpm/amazonlinux/python3-lxml?arch=x86_64&distro=amazonlinux-2 amazonlinux python3-lxml < 3.2.1-4.amzn2.0.6 amazonlinux-2 x86_64
Affected pkg:rpm/amazonlinux/python3-lxml?arch=i686&distro=amazonlinux-2 amazonlinux python3-lxml < 3.2.1-4.amzn2.0.6 amazonlinux-2 i686
Affected pkg:rpm/amazonlinux/python3-lxml?arch=aarch64&distro=amazonlinux-2 amazonlinux python3-lxml < 3.2.1-4.amzn2.0.6 amazonlinux-2 aarch64
Affected pkg:rpm/amazonlinux/python-lxml?arch=x86_64&distro=amazonlinux-2 amazonlinux python-lxml < 3.2.1-4.amzn2.0.6 amazonlinux-2 x86_64
Affected pkg:rpm/amazonlinux/python-lxml?arch=i686&distro=amazonlinux-2 amazonlinux python-lxml < 3.2.1-4.amzn2.0.6 amazonlinux-2 i686
Affected pkg:rpm/amazonlinux/python-lxml?arch=aarch64&distro=amazonlinux-2 amazonlinux python-lxml < 3.2.1-4.amzn2.0.6 amazonlinux-2 aarch64
Affected pkg:rpm/amazonlinux/python-lxml-docs?arch=noarch&distro=amazonlinux-2 amazonlinux python-lxml-docs < 3.2.1-4.amzn2.0.6 amazonlinux-2 noarch
Affected pkg:rpm/amazonlinux/python-lxml-debuginfo?arch=x86_64&distro=amazonlinux-2 amazonlinux python-lxml-debuginfo < 3.2.1-4.amzn2.0.6 amazonlinux-2 x86_64
Affected pkg:rpm/amazonlinux/python-lxml-debuginfo?arch=i686&distro=amazonlinux-2 amazonlinux python-lxml-debuginfo < 3.2.1-4.amzn2.0.6 amazonlinux-2 i686
Affected pkg:rpm/amazonlinux/python-lxml-debuginfo?arch=aarch64&distro=amazonlinux-2 amazonlinux python-lxml-debuginfo < 3.2.1-4.amzn2.0.6 amazonlinux-2 aarch64
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date