CVE-2014-3146
Fixed in a distro release EPSS 6%CVSS 6.1
Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via control characters in the link scheme to the clean_html function.
Products: lxml
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | lxml | 3.3.5 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2 | python-lxml | 3.2.1-4.amzn2.0.4 |
| Amazon Linux 2 | python-lxml-docs | 3.2.1-4.amzn2.0.4 |
| Debian 12 | lxml | 3.3.5-1 |
| Debian 13 | lxml | 3.3.5-1 |
| Debian 14 | lxml | 3.3.5-1 |
| Debian 6.0 | lxml | 2.2.8-2+deb6u1 |
| Debian 7 | lxml | 2.3.2-1+deb7u1 |
| Ubuntu 14.04 LTS | lxml | 3.3.3-1ubuntu0.1 |