CVE-2018-19787
Fixed in a distro release EPSS 2%CVSS 6.1
An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by "j a v a s c r i p t:" in Internet Explorer. This is a similar issue to CVE-2014-3146.
Products: lxml, debian_linux, canonical ubuntu_linux
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | lxml | 4.2.5 |
| PyPI | lxml | 6be1d081b49c97cfd7b3fbd934a193b668629109 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2 | python-lxml | 3.2.1-4.amzn2.0.4 |
| Amazon Linux 2 | python-lxml-docs | 3.2.1-4.amzn2.0.4 |
| Debian 12 | lxml | 4.2.5-1 |
| Debian 13 | lxml | 4.2.5-1 |
| Debian 14 | lxml | 4.2.5-1 |
| Debian 9 | lxml | 3.7.1-1+deb9u1 |
| SUSE Enterprise Storage 7 | python-lxml | 4.7.1-3.7.1 |
| SUSE HPE Helion OpenStack 8 | python-lxml | 3.6.1-8.5.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS | python-lxml | 4.7.1-3.7.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS | python-lxml | 4.7.1-3.7.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP3 | python-lxml | 4.7.1-3.7.1 |
| SUSE Linux Enterprise Module for Python 2 15 SP3 | python-lxml | 4.7.1-3.7.1 |
| SUSE Linux Enterprise Real Time 15 SP2 | python-lxml | 4.7.1-3.7.1 |
| SUSE Linux Enterprise Server 12 SP5 | python-lxml | 3.6.1-8.5.1 |
| SUSE Linux Enterprise Server 15 SP2-BCL | python-lxml | 4.7.1-3.7.1 |
| SUSE Linux Enterprise Server 15 SP2-LTSS | python-lxml | 4.7.1-3.7.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | python-lxml | 3.6.1-8.5.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP2 | python-lxml | 4.7.1-3.7.1 |
| SUSE Manager Proxy 4.1 | python-lxml | 4.7.1-3.7.1 |
| SUSE Manager Retail Branch Server 4.1 | python-lxml | 4.7.1-3.7.1 |
| SUSE Manager Server 4.1 | python-lxml | 4.7.1-3.7.1 |
| SUSE OpenStack Cloud 8 | python-lxml | 3.6.1-8.5.1 |
| SUSE OpenStack Cloud 9 | ardana-barbican | 9.0+git.1644879908.8a641c1-3.13.1 |
| SUSE OpenStack Cloud 9 | grafana | 6.7.4-3.26.1 |
| SUSE OpenStack Cloud 9 | openstack-barbican | 7.0.1~dev24-3.14.1 |
| SUSE OpenStack Cloud 9 | openstack-cinder | 13.0.10~dev24-3.34.2 |
| SUSE OpenStack Cloud 9 | openstack-heat-gbp | 14.0.1~dev4-3.9.1 |
| SUSE OpenStack Cloud 9 | openstack-horizon-plugin-gbp-ui | 14.0.1~dev3-3.9.1 |
| SUSE OpenStack Cloud 9 | openstack-ironic | 11.1.5~dev18-3.28.2 |
| SUSE OpenStack Cloud 9 | openstack-keystone | 14.2.1~dev9-3.28.2 |
| SUSE OpenStack Cloud 9 | openstack-neutron | 13.0.8~dev206-3.40.1 |
| SUSE OpenStack Cloud 9 | openstack-neutron-gbp | 14.0.1~dev33-3.31.1 |
| SUSE OpenStack Cloud 9 | python-Pillow | 5.2.0-3.17.1 |
| SUSE OpenStack Cloud 9 | python-XStatic-jquery-ui | 1.13.0.1-4.3.1 |
| SUSE OpenStack Cloud 9 | python-lxml | 4.2.4-3.3.1 |
| SUSE OpenStack Cloud 9 | release-notes-suse-openstack-cloud | 9.20220413-3.30.1 |
| SUSE OpenStack Cloud 9 | venv-openstack-barbican | 7.0.1~dev24-3.35.2 |
| SUSE OpenStack Cloud 9 | venv-openstack-cinder | 13.0.10~dev24-3.38.1 |
| SUSE OpenStack Cloud 9 | venv-openstack-designate | 7.0.2~dev2-3.35.1 |
| SUSE OpenStack Cloud 9 | venv-openstack-glance | 17.0.1~dev30-3.33.1 |
| SUSE OpenStack Cloud 9 | venv-openstack-heat | 11.0.4~dev4-3.35.1 |
| SUSE OpenStack Cloud 9 | venv-openstack-horizon | 14.1.1~dev11-4.39.1 |
| SUSE OpenStack Cloud 9 | venv-openstack-ironic | 11.1.5~dev18-4.33.1 |
| SUSE OpenStack Cloud 9 | venv-openstack-keystone | 14.2.1~dev9-3.36.1 |
| SUSE OpenStack Cloud 9 | venv-openstack-magnum | 7.2.1~dev1-4.35.1 |
| SUSE OpenStack Cloud 9 | venv-openstack-manila | 7.4.2~dev60-3.41.1 |
| SUSE OpenStack Cloud 9 | venv-openstack-monasca | 2.7.1~dev10-3.37.1 |
| SUSE OpenStack Cloud 9 | venv-openstack-monasca-ceilometer | 1.8.2~dev3-3.35.1 |
| SUSE OpenStack Cloud 9 | venv-openstack-neutron | 13.0.8~dev206-6.39.1 |
| SUSE OpenStack Cloud 9 | venv-openstack-nova | 18.3.1~dev91-3.39.1 |
| SUSE OpenStack Cloud 9 | venv-openstack-octavia | 3.2.3~dev7-4.35.1 |
| SUSE OpenStack Cloud 9 | venv-openstack-sahara | 9.0.2~dev15-3.35.1 |
| SUSE OpenStack Cloud 9 | venv-openstack-swift | 2.19.2~dev48-2.30.1 |
| SUSE OpenStack Cloud Crowbar 8 | python-lxml | 3.6.1-8.5.1 |
| SUSE OpenStack Cloud Crowbar 9 | grafana | 6.7.4-3.26.1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-barbican | 7.0.1~dev24-3.14.1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-cinder | 13.0.10~dev24-3.34.2 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-heat-gbp | 14.0.1~dev4-3.9.1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-horizon-plugin-gbp-ui | 14.0.1~dev3-3.9.1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-ironic | 11.1.5~dev18-3.28.2 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-keystone | 14.2.1~dev9-3.28.2 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-neutron | 13.0.8~dev206-3.40.1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-neutron-gbp | 14.0.1~dev33-3.31.1 |
| SUSE OpenStack Cloud Crowbar 9 | python-Pillow | 5.2.0-3.17.1 |
| SUSE OpenStack Cloud Crowbar 9 | python-XStatic-jquery-ui | 1.13.0.1-4.3.1 |
| SUSE OpenStack Cloud Crowbar 9 | python-lxml | 4.2.4-3.3.1 |
| SUSE OpenStack Cloud Crowbar 9 | release-notes-suse-openstack-cloud | 9.20220413-3.30.1 |
| SUSE OpenStack Cloud Crowbar 9 | rubygem-sinatra | 1.4.6-4.3.1 |
| Ubuntu 14.04 LTS | lxml | 3.3.3-1ubuntu0.2 |
| Ubuntu 16.04 LTS | lxml | 3.5.0-1ubuntu0.1 |
| Ubuntu 18.04 LTS | lxml | 4.2.1-1ubuntu0.1 |
| openSUSE Leap 15.3 | python-lxml | 4.7.1-3.7.1 |