Bug 1184177 - (CVE-2021-28957) VUL-0: CVE-2021-28957: python-lxml,python3-lxml:missing input sanitization for formaction HTML5 attributes may lead to XSS
(CVE-2021-28957)
VUL-0: CVE-2021-28957: python-lxml,python3-lxml:missing input sanitization fo...
Status: IN_PROGRESS
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Normal
: ---
Assigned To: Security Team bot
Security Team bot
https://smash.suse.de/issue/280170/
CVSSv3.1:SUSE:CVE-2021-28957:6.1:(AV:...
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2021-03-30 15:45 UTC by Alexander Bergmann
Modified: 2022-11-17 16:11 UTC (History)
10 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Comment 1 Lukas Lansky 2021-11-03 16:04:33 UTC
Any plans to fix this in SUSE:SLE-15-SP2:Update? Thank you.
Comment 4 Thomas Schraitle 2022-02-23 08:13:05 UTC
Sorry for the delay. As the update was accepted, set this to resolved.
Comment 5 Gianluca Gabrielli 2022-02-23 08:35:11 UTC
Hi Thomas,

when dealing with security-related BZ issues, please do not close them yourself, instead re-assign them back to security-team@suse.de. This way we can double-check if the patch is successfully delivered on all affected products, then close the issue.

(In reply to Thomas Schraitle from comment #4)
> Sorry for the delay. As the update was accepted, set this to resolved.

Your SR (Submission Request) SR#263873 [0] has been accepted within a maintenance incident, but it's not yet released to any product. A RR (Release Request) RR#264553 [1] has been created out of your SR and it's currently under QA. Only when the RR will be accepted then the update is released to the costumers.

Moreover, there are more codestreams flagged as affected that requires a submission from you. Usually, this is our (security-team) job to inform the maintainer about which packages are affected. Unfortunately, who reported this issue forgot that step. Please submit to the following codestream:

SUSE:SLE-11-SP3:Update/python-lxml      2.3.6
SUSE:SLE-11:Update/python-lxml          2.1.2
SUSE:SLE-12-SP2:Update/python-lxml      3.6.1
SUSE:SLE-15-SP2:Update/python-lxml      4.4.2
SUSE:SLE-15:Update/python-lxml          4.0.0
SUSE:SLE-12-SP4:Update/python3-lxml     3.6.1
SUSE:SLE-12:Update/python3-lxml         3.3.5

@cloud-team, please submit to the following one:
SUSE:SLE-12-SP4:Update:Products:Cloud9:Update/python-lxml   4.2.4

Cheers,
Gianluca

[0] https://build.suse.de/request/show/263873
[1] https://build.suse.de/request/show/264553
Comment 6 Thomas Schraitle 2022-02-23 08:38:38 UTC
Thanks Gianluca, much appreciated your information and sorry for the noise.

I haven't forgot the other parts. One of my colleagues has left the company and I take over some of his tasks. But I'm looking into the list right now. :)
Comment 11 Swamp Workflow Management 2022-03-10 20:20:16 UTC
openSUSE-SU-2022:0803-1: An update that fixes four vulnerabilities is now available.

Category: security (important)
Bug References: 1118088,1179534,1184177,1193752
CVE References: CVE-2018-19787,CVE-2020-27783,CVE-2021-28957,CVE-2021-43818
JIRA References: 
Sources used:
openSUSE Leap 15.4 (src):    python-lxml-4.7.1-3.7.1
openSUSE Leap 15.3 (src):    python-lxml-4.7.1-3.7.1
Comment 12 Swamp Workflow Management 2022-03-10 20:22:02 UTC
SUSE-SU-2022:0803-1: An update that fixes four vulnerabilities is now available.

Category: security (important)
Bug References: 1118088,1179534,1184177,1193752
CVE References: CVE-2018-19787,CVE-2020-27783,CVE-2021-28957,CVE-2021-43818
JIRA References: 
Sources used:
SUSE Manager Server 4.1 (src):    python-lxml-4.7.1-3.7.1
SUSE Manager Retail Branch Server 4.1 (src):    python-lxml-4.7.1-3.7.1
SUSE Manager Proxy 4.1 (src):    python-lxml-4.7.1-3.7.1
SUSE Linux Enterprise Server for SAP 15-SP2 (src):    python-lxml-4.7.1-3.7.1
SUSE Linux Enterprise Server 15-SP2-LTSS (src):    python-lxml-4.7.1-3.7.1
SUSE Linux Enterprise Server 15-SP2-BCL (src):    python-lxml-4.7.1-3.7.1
SUSE Linux Enterprise Realtime Extension 15-SP2 (src):    python-lxml-4.7.1-3.7.1
SUSE Linux Enterprise Module for Python2 15-SP3 (src):    python-lxml-4.7.1-3.7.1
SUSE Linux Enterprise Module for Basesystem 15-SP4 (src):    python-lxml-4.7.1-3.7.1
SUSE Linux Enterprise Module for Basesystem 15-SP3 (src):    python-lxml-4.7.1-3.7.1
SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (src):    python-lxml-4.7.1-3.7.1
SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (src):    python-lxml-4.7.1-3.7.1
SUSE Enterprise Storage 7 (src):    python-lxml-4.7.1-3.7.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 13 Swamp Workflow Management 2022-03-17 20:17:31 UTC
SUSE-SU-2022:0895-1: An update that fixes four vulnerabilities is now available.

Category: security (moderate)
Bug References: 1118088,1179534,1184177,1193752
CVE References: CVE-2018-19787,CVE-2020-27783,CVE-2021-28957,CVE-2021-43818
JIRA References: 
Sources used:
SUSE OpenStack Cloud Crowbar 8 (src):    python-lxml-3.6.1-8.5.1
SUSE OpenStack Cloud 8 (src):    python-lxml-3.6.1-8.5.1
SUSE Linux Enterprise Server 12-SP5 (src):    python-lxml-3.6.1-8.5.1
HPE Helion Openstack 8 (src):    python-lxml-3.6.1-8.5.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 14 Christian Almeida de Oliveira 2022-04-22 09:42:53 UTC
https://build.opensuse.org/request/show/967839  accepted
Comment 19 Swamp Workflow Management 2022-05-04 19:17:57 UTC
SUSE-SU-2022:1536-1: An update that fixes 8 vulnerabilities is now available.

Category: security (important)
Bug References: 1118088,1184177,1196249,1196877,1197279,1197417,1197637,1198556
CVE References: CVE-2018-19787,CVE-2021-28957,CVE-2022-0778,CVE-2022-22934,CVE-2022-22935,CVE-2022-22936,CVE-2022-22941,CVE-2022-24302
JIRA References: 
Sources used:
SUSE Manager Tools 12-BETA (src):    venv-salt-minion-3004-3.9.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 20 Swamp Workflow Management 2022-05-18 19:16:20 UTC
SUSE-SU-2022:1729-1: An update that solves 17 vulnerabilities, contains two features and has one errata is now available.

Category: security (important)
Bug References: 1118088,1179534,1184177,1186380,1189390,1189794,1192070,1192073,1192075,1193597,1193688,1193752,1194521,1194551,1194552,1194952,1194954,1199138
CVE References: CVE-2018-19787,CVE-2020-27783,CVE-2021-28957,CVE-2021-38155,CVE-2021-40085,CVE-2021-41182,CVE-2021-41183,CVE-2021-41184,CVE-2021-43813,CVE-2021-43818,CVE-2021-44716,CVE-2022-22815,CVE-2022-22816,CVE-2022-22817,CVE-2022-23451,CVE-2022-23452,CVE-2022-29970
JIRA References: SOC-11620,SOC-11621
Sources used:
SUSE OpenStack Cloud Crowbar 9 (src):    grafana-6.7.4-3.26.1, openstack-barbican-7.0.1~dev24-3.14.1, openstack-cinder-13.0.10~dev24-3.34.2, openstack-heat-gbp-14.0.1~dev4-3.9.1, openstack-horizon-plugin-gbp-ui-14.0.1~dev3-3.9.1, openstack-ironic-11.1.5~dev18-3.28.2, openstack-keystone-14.2.1~dev9-3.28.2, openstack-neutron-13.0.8~dev206-3.40.1, openstack-neutron-gbp-14.0.1~dev33-3.31.1, python-Pillow-5.2.0-3.17.1, python-XStatic-jquery-ui-1.13.0.1-4.3.1, python-lxml-4.2.4-3.3.1, release-notes-suse-openstack-cloud-9.20220413-3.30.1, rubygem-sinatra-1.4.6-4.3.1
SUSE OpenStack Cloud 9 (src):    ardana-barbican-9.0+git.1644879908.8a641c1-3.13.1, grafana-6.7.4-3.26.1, openstack-barbican-7.0.1~dev24-3.14.1, openstack-cinder-13.0.10~dev24-3.34.2, openstack-heat-gbp-14.0.1~dev4-3.9.1, openstack-horizon-plugin-gbp-ui-14.0.1~dev3-3.9.1, openstack-ironic-11.1.5~dev18-3.28.2, openstack-keystone-14.2.1~dev9-3.28.2, openstack-neutron-13.0.8~dev206-3.40.1, openstack-neutron-gbp-14.0.1~dev33-3.31.1, python-Pillow-5.2.0-3.17.1, python-XStatic-jquery-ui-1.13.0.1-4.3.1, python-lxml-4.2.4-3.3.1, release-notes-suse-openstack-cloud-9.20220413-3.30.1, venv-openstack-barbican-7.0.1~dev24-3.35.2, venv-openstack-cinder-13.0.10~dev24-3.38.1, venv-openstack-designate-7.0.2~dev2-3.35.1, venv-openstack-glance-17.0.1~dev30-3.33.1, venv-openstack-heat-11.0.4~dev4-3.35.1, venv-openstack-horizon-14.1.1~dev11-4.39.1, venv-openstack-ironic-11.1.5~dev18-4.33.1, venv-openstack-keystone-14.2.1~dev9-3.36.1, venv-openstack-magnum-7.2.1~dev1-4.35.1, venv-openstack-manila-7.4.2~dev60-3.41.1, venv-openstack-monasca-2.7.1~dev10-3.37.1, venv-openstack-monasca-ceilometer-1.8.2~dev3-3.35.1, venv-openstack-neutron-13.0.8~dev206-6.39.1, venv-openstack-nova-18.3.1~dev91-3.39.1, venv-openstack-octavia-3.2.3~dev7-4.35.1, venv-openstack-sahara-9.0.2~dev15-3.35.1, venv-openstack-swift-2.19.2~dev48-2.30.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 21 Thomas Schraitle 2022-08-08 12:26:45 UTC
Hi Gayane,
I saw from comment#18 you did the update (many thanks!).
For some reasons, I'm still assigned to this bug. It seems, however, this bug is already fixed. Is my impression correct?

Thank you!
Comment 22 Gayane Osipyan 2022-08-08 16:07:22 UTC
(In reply to Thomas Schraitle from comment #21)
> Hi Gayane,
> I saw from comment#18 you did the update (many thanks!).
> For some reasons, I'm still assigned to this bug. It seems, however, this
> bug is already fixed. Is my impression correct?
> 
> Thank you!

Hi Thomas,
Maintenance Updates released for Cloud9 .
Regards,
Gayane
Comment 23 Gianluca Gabrielli 2022-08-09 07:48:53 UTC
same as bsc#1179534c10
Comment 33 Swamp Workflow Management 2022-11-01 14:31:22 UTC
SUSE-SU-2022:3836-1: An update that fixes two vulnerabilities is now available.

Category: security (moderate)
Bug References: 1179534,1184177
CVE References: CVE-2020-27783,CVE-2021-28957
JIRA References: 
Sources used:
openSUSE Leap 15.3 (src):    python-lxml-4.0.0-150000.4.3.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 34 Swamp Workflow Management 2022-11-10 17:22:55 UTC
SUSE-SU-2022:3934-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1184177
CVE References: CVE-2021-28957
JIRA References: 
Sources used:
SUSE Linux Enterprise Module for Public Cloud 12 (src):    python3-lxml-3.3.5-3.15.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 35 Swamp Workflow Management 2022-11-10 17:27:00 UTC
SUSE-SU-2022:3937-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1184177
CVE References: CVE-2021-28957
JIRA References: 
Sources used:
SUSE Linux Enterprise Server 12-SP5 (src):    python3-lxml-3.6.1-3.6.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.