p PatchFirst

CVE-2018-7753

CVE-2018-7753

This page contains facts from public vulnerability sources. Check the original advisory before updating.

An issue was discovered in Bleach 2.1.x before 2.1.3. Attributes that have URI values weren't properly sanitized if the values contained character entities. Using character entities, it was possible to construct a URI value with a scheme that was not allowed that would slide through unsanitized.

CVSS 9.8 · Critical · EPSS 2.2% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • python-bleach Debian:12

    Affected ranges
    • ECOSYSTEM: < 2.1.3-1

    Update to 2.1.3-1

  • python-bleach Debian:13

    Affected ranges
    • ECOSYSTEM: < 2.1.3-1

    Update to 2.1.3-1

  • python-bleach Debian:14

    Affected ranges
    • ECOSYSTEM: < 2.1.3-1

    Update to 2.1.3-1

  • bleach PyPI

    Versions
    • 2.1
    • 2.1.1
    • 2.1.2
    Affected ranges
    • ECOSYSTEM: ≥ 2.1.0, < 2.1.3

    Update to 2.1.3

  • bleach PyPI

    Versions
    • 2.1
    • 2.1.1
    • 2.1.2
    Affected ranges
    • GIT: < c5df5789ec3471a31311f42c2d19fc2cf21b35ef
    • ECOSYSTEM: ≥ 2.1, < 2.1.3

    Update to 2.1.3

  • python-bleach Ubuntu:Pro:18.04:LTS

    Versions
    • 2.0-1
    • 2.1.2-1
    Affected ranges
    • ECOSYSTEM: < 2.1.2-1ubuntu0.1~esm1

    Update to 2.1.2-1ubuntu0.1~esm1

Original sources

Check your server →