diff options
| author | Danilo G. Baio <dbaio@FreeBSD.org> | 2020-04-27 01:39:27 +0800 |
|---|---|---|
| committer | Danilo G. Baio <dbaio@FreeBSD.org> | 2020-04-27 01:39:27 +0800 |
| commit | 50a60f5294e7b34d8de36cc6b6cc7df41ffb627d (patch) | |
| tree | 81b67e95a74cc562ae67d1d8654020c387fe694d /security | |
| parent | 9d2822a25a1264f73c89cbd9ee66971f2c3e85db (diff) | |
| download | freebsd-ports-gnome-50a60f5294e7b34d8de36cc6b6cc7df41ffb627d.tar.gz freebsd-ports-gnome-50a60f5294e7b34d8de36cc6b6cc7df41ffb627d.tar.zst freebsd-ports-gnome-50a60f5294e7b34d8de36cc6b6cc7df41ffb627d.zip | |
security/vuxml: Document www/py-bleach issue
PR: 245943
Security: CVE-2020-6817
Diffstat (limited to 'security')
| -rw-r--r-- | security/vuxml/vuln.xml | 36 |
1 files changed, 36 insertions, 0 deletions
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index e6b42920cfa3..92c247622d98 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -58,6 +58,42 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> + <vuln vid="4c52ec3c-86f3-11ea-b5b4-641c67a117d8"> + <topic>py-bleach -- regular expression denial-of-service</topic> + <affects> + <package> + <name>py27-bleach</name> + <name>py35-bleach</name> + <name>py36-bleach</name> + <name>py37-bleach</name> + <name>py38-bleach</name> + <range><lt>3.1.4</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>Bleach developers reports:</p> + <blockquote cite="https://github.com/mozilla/bleach/security/advisories/GHSA-vqhp-cxgc-6wmm"> + <p>bleach.clean behavior parsing style attributes could result in a + regular expression denial of service (ReDoS).</p> + <p>Calls to bleach.clean with an allowed tag with an allowed style + attribute are vulnerable to ReDoS. For example, bleach.clean(..., + attributes={'a': ['style']}).</p> + </blockquote> + </body> + </description> + <references> + <url>https://github.com/mozilla/bleach/security/advisories/GHSA-vqhp-cxgc-6wmm</url> + <url>https://bugzilla.mozilla.org/show_bug.cgi?id=1623633</url> + <cvename>CVE-2020-6817</cvename> + <freebsdpr>ports/245943</freebsdpr> + </references> + <dates> + <discovery>2019-03-09</discovery> + <entry>2020-04-26</entry> + </dates> + </vuln> + <vuln vid="21d59ea3-8559-11ea-a5e2-d4c9ef517024"> <topic>MySQL Server -- Multiple vulerabilities</topic> <affects> |