CVE-2018-19787
python3-lxml: An issue was discovered in lxml before 4.2.5
CVE-2018-19787 is fixed in 2 products on 1 platform, first by python-lxml 4.2.1-1ubuntu0.1, released December 1, 2018. It is not reported as exploited. Patch Radar priority: Routine.
Routine
CVSS
n/a
Medium
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0244
84th percentile
An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by "j a v a s c r i p t:" in Internet Explorer. This is a similar issue to CVE-2014-3146.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| python-lxml · Ubuntu 18.04.6 LTS (bionic) | 4.2.1-1ubuntu0.1 | python-lxml 4.2.1-1ubuntu0.1 | Dec 1, 2018 |
| python3-lxml · Ubuntu 18.04.6 LTS (bionic) | 4.2.1-1ubuntu0.1 | python3-lxml 4.2.1-1ubuntu0.1 | Dec 1, 2018 |