python-bleach is an allowlist-based Python library that sanitizes HTML text by escaping or stripping tags and attributes.
On April 6, Debian published a security update fixing a cross-site scripting vulnerability found in the Python HTML sanitizing library bleach. Details below.
Vulnerability Details
Source: https://lists.debian.org/debian-lts-announce/2021/04/msg00006.html
CVE-2021-23980
Severity: Important
XSS attacks exploit flaws left behind during web development, injecting malicious code into pages so that users load and execute attacker-crafted web programs.
A cross-site scripting (XSS) vulnerability was found in python bleach. The XSS is triggered through the allowed math or svg namespaces, p or br elements, and the style, title, noscript, script, textarea, noframes, iframe or xmp tags combined with strip_comments = False.
Affected Products and Versions
The vulnerability affects Debian 9 Stretch python-bleach versions prior to 2.0-1+deb9u1.
Fix
For Debian 9 Stretch, this issue is fixed in python-bleach 2.0-1+deb9u1 — update the package promptly.
More vulnerability details and upgrade instructions are on the official site: https://www.debian.org/lts/security/