{"id":"openSUSE-SU-2021:0552-1","summary":"Security update for python-bleach","details":"This update for python-bleach fixes the following issues:\n\n- CVE-2021-23980: Fixed mutation XSS on bleach.clean with specific\n  combinations of allowed tags (boo#1184547)\n\nUpdate to 3.1.5:\n\n* replace missing ``setuptools`` dependency with ``packaging``. Thank you Benjamin Peterson.\n\nUpdate to 3.1.4 (boo#1168280, CVE-2020-6817):\n\n* ``bleach.clean`` behavior parsing style attributes could result in a\n  regular expression denial of service (ReDoS).\n  Calls to ``bleach.clean`` with an allowed tag with an allowed\n  ``style`` attribute were vulnerable to ReDoS. For example,\n  ``bleach.clean(..., attributes={'a': ['style']})``.\n* Style attributes with dashes, or single or double quoted values are\n  cleaned instead of passed through.\n\nupdate to 3.1.3 (boo#1167379, CVE-2020-6816):\n\n* Add relative link to code of conduct. (#442)\n* Drop deprecated 'setup.py test' support. (#507)\n* Fix typo: curren -\u003e current in tests/test_clean.py (#504)\n* Test on PyPy 7\n* Drop test support for end of life Python 3.4\n* ``bleach.clean`` behavior parsing embedded MathML and SVG content\n  with RCDATA tags did not match browser behavior and could result in\n  a mutation XSS.\n  Calls to ``bleach.clean`` with ``strip=False`` and ``math`` or\n  ``svg`` tags and one or more of the RCDATA tags ``script``,\n  ``noscript``, ``style``, ``noframes``, ``iframe``, ``noembed``, or\n  ``xmp`` in the allowed tags whitelist were vulnerable to a mutation\n  XSS.\n","modified":"2026-03-11T07:33:00.374617Z","published":"2021-04-14T14:51:29Z","related":["CVE-2020-6816","CVE-2020-6817","CVE-2021-23980"],"upstream":["CVE-2020-6816","CVE-2020-6817","CVE-2021-23980"],"references":[{"type":"ADVISORY","url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YFAKMJGUZHUTZ53ZAID6PRVP5MSLXPGV/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1167379"},{"type":"REPORT","url":"https://bugzilla.suse.com/1168280"},{"type":"REPORT","url":"https://bugzilla.suse.com/1184547"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2020-6816"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2020-6817"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2021-23980"}],"affected":[{"package":{"name":"python-bleach","ecosystem":"openSUSE:Leap 15.2","purl":"pkg:rpm/opensuse/python-bleach&distro=openSUSE%20Leap%2015.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.5-lp152.2.3.1"}]}],"ecosystem_specific":{"binaries":[{"python2-bleach":"3.1.5-lp152.2.3.1","python3-bleach":"3.1.5-lp152.2.3.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2021:0552-1.json"}}],"schema_version":"1.7.5"}