Ubuntu Security Notice 4666-2 - USN-4666-1 partially fixed a vulnerability in lxml, but an additional patch was needed. This update provides the corresponding additional patch in order to properly fix the vulnerability. It was discovered that lxml incorrectly handled certain HTML. An attacker could possibly use this issue to cross-site scripting attacks.
ac4ca768b5ce952dba394cc6b1930615a99b670e0cb573d027161391c298c8cb
=========================================================================
Ubuntu Security Notice USN-4666-2
December 11, 2020
lxml vulnerability
=========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.10
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
- Ubuntu 14.04 ESM
- Ubuntu 12.04 ESM
Summary:
lxml could allow cross-site scripting (XSS) attacks.
Software Description:
- lxml: pythonic binding for the libxml2 and libxslt librarie
Details:
USN-4666-1 partially fixed a vulnerability in lxml, but an additional patch was needed. This update provides
the corresponding additional patch in order to properly fix the vulnerability.
Original advisory details:
It was discovered that lxml incorrectly handled certain HTML.
An attacker could possibly use this issue to cross-site scripting (XSS) attacks.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.10:
python3-lxml 4.5.2-1ubuntu0.3
Ubuntu 20.04 LTS:
python-lxml 4.5.0-1ubuntu0.2
python3-lxml 4.5.0-1ubuntu0.2
Ubuntu 18.04 LTS:
python-lxml 4.2.1-1ubuntu0.3
python3-lxml 4.2.1-1ubuntu0.3
Ubuntu 16.04 LTS:
python-lxml 3.5.0-1ubuntu0.3
python3-lxml 3.5.0-1ubuntu0.3
Ubuntu 14.04 ESM:
python-lxml 3.3.3-1ubuntu0.2+esm2
python3-lxml 3.3.3-1ubuntu0.2+esm2
Ubuntu 12.04 ESM:
python-lxml 2.3.2-1ubuntu0.5
python3-lxml 2.3.2-1ubuntu0.5
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/4666-2
https://usn.ubuntu.com/4666-1
CVE-2020-27783
Package Information:
https://launchpad.net/ubuntu/+source/lxml/4.5.2-1ubuntu0.3
https://launchpad.net/ubuntu/+source/lxml/4.5.0-1ubuntu0.2
https://launchpad.net/ubuntu/+source/lxml/4.2.1-1ubuntu0.3
https://launchpad.net/ubuntu/+source/lxml/3.5.0-1ubuntu0.3