high8.2

CVE-2021-43818

lxml's HTML Cleaner allows crafted and SVG embedded scripts to pass through

Impact

### Impact The HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG files embedded using data URIs. Users that employ the HTML cleaner in a security relevant context should upgrade to lxml 4.6.5. ### Patches The issue has been resolved in lxml 4.6.5. ### Workarounds None. ### References The issues are tracked under the report IDs GHSL-2021-1037 and GHSL-2021-1038.

Affected packages

Ecosystem	Package	Affected	Fixed in
pip	`lxml`	< 4.6.5	4.6.5

Affected products

Vendor	Product	Affected versions
Lxml	Lxml	before 4.6.5
Fedoraproject	Fedora	Versions 34, 35
Debian	Debian Linux	Versions 9.0, 10.0, 11.0
Netapp	Solidfire	All versions
Netapp	Solidfire Enterprise Sds	All versions
Netapp	Hci Storage Node Firmware	All versions
Oracle	Communications Cloud Native Core Binding Support Function	Version 22.1.3
Oracle	Communications Cloud Native Core Network Exposure Function	Version 22.1.1
Oracle	Communications Cloud Native Core Policy	Version 22.2.0
Oracle	Http Server	Versions 12.2.1.3.0, 12.2.1.4.0
Oracle	Zfs Storage Appliance Kit	Version 8.8

Weakness classification

CWE-74 CWE-79