lxml's HTML Cleaner allows crafted and SVG embedded scripts to pass through

高 7.1CVE-2021-43818 · GHSA-55x5-fj6c-h6m8 · PYSEC-2021-852 · 13/12/2021 公開 · 17/06/2026 更新

要点

CVE-2021-43818 は lxml, lxml (lxml), communications cloud native core binding support function (oracle) に影響する深刻度「高」 (CVSS 7.1) の脆弱性です。
今後30日間に悪用される確率（EPSS）：2.7%（全脆弱性の 85.7% より高い）。
対処：4.6.5 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
lxml PyPI	`< 4.6.5`	`4.6.5`
lxml lxml	`< 4.6.5`	`4.6.5`
communications cloud native core binding support function oracle	`= 22.1.3`	修正版なし
communications cloud native core network exposure function oracle	`= 22.1.1`	修正版なし
communications cloud native core policy oracle	`= 22.2.0`	修正版なし
http server oracle	`= 12.2.1.3.0= 12.2.1.4.0`	修正版なし
zfs storage appliance kit oracle	`= 8.8`	修正版なし

概要

Impact

The HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG files embedded using data URIs.

Users that employ the HTML cleaner in a security relevant context should upgrade to lxml 4.6.5.

Patches

The issue has been resolved in lxml 4.6.5.

Workarounds

None.

References

The issues are tracked under the report IDs GHSL-2021-1037 and GHSL-2021-1038.

NVD の説明

lxml is a library for processing XML and HTML in the Python language. Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG files embedded using data URIs. Users that employ the HTML cleaner in a security relevant context should upgrade to lxml 4.6.5 to receive a patch. There are no known workarounds available.