Issued:
2021-05-18
Updated:
2021-05-18

RHSA-2021:1898 - Security Advisory

Synopsis

Moderate: python-lxml security update

Type/Severity

Security Advisory: Moderate

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for python-lxml is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

lxml is an XML processing library providing access to libxml2 and libxslt libraries using the Python ElementTree API.

Security Fix(es):

  • python-lxml: mXSS due to the use of improper parser (CVE-2020-27783)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.4 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 8 x86_64
  • Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.6 x86_64
  • Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.4 x86_64
  • Red Hat Enterprise Linux Server - AUS 8.6 x86_64
  • Red Hat Enterprise Linux Server - AUS 8.4 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 8 s390x
  • Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.6 s390x
  • Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.4 s390x
  • Red Hat Enterprise Linux for Power, little endian 8 ppc64le
  • Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.6 ppc64le
  • Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.4 ppc64le
  • Red Hat Enterprise Linux Server - TUS 8.6 x86_64
  • Red Hat Enterprise Linux Server - TUS 8.4 x86_64
  • Red Hat Enterprise Linux for ARM 64 8 aarch64
  • Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.6 aarch64
  • Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.4 aarch64
  • Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.6 ppc64le
  • Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.4 ppc64le
  • Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.6 x86_64
  • Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.4 x86_64

Fixes

  • BZ - 1901633 - CVE-2020-27783 python-lxml: mXSS due to the use of improper parser

Red Hat Enterprise Linux for x86_64 8

SRPM
python-lxml-4.2.3-2.el8.src.rpm SHA-256: 980b0120d96a2bca820ea3381528eff509d8406caca6bf42404b0ce0a039c538
x86_64
python-lxml-debugsource-4.2.3-2.el8.x86_64.rpm SHA-256: 3bdef082cb6ece1732f84727e0833b2b78326c0f1b1198ecb7213bf66cf4ced7
python3-lxml-4.2.3-2.el8.x86_64.rpm SHA-256: 9fbd2bdce41676fd20996218494dde85c04171740ed42fe5d46e062319a83e8f
python3-lxml-debuginfo-4.2.3-2.el8.x86_64.rpm SHA-256: 8c726f2c46af1983dd20379a25677f3f14b4c23b0342ca752844bf2f9c543a73

Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.6

SRPM
python-lxml-4.2.3-2.el8.src.rpm SHA-256: 980b0120d96a2bca820ea3381528eff509d8406caca6bf42404b0ce0a039c538
x86_64
python-lxml-debugsource-4.2.3-2.el8.x86_64.rpm SHA-256: 3bdef082cb6ece1732f84727e0833b2b78326c0f1b1198ecb7213bf66cf4ced7
python3-lxml-4.2.3-2.el8.x86_64.rpm SHA-256: 9fbd2bdce41676fd20996218494dde85c04171740ed42fe5d46e062319a83e8f
python3-lxml-debuginfo-4.2.3-2.el8.x86_64.rpm SHA-256: 8c726f2c46af1983dd20379a25677f3f14b4c23b0342ca752844bf2f9c543a73

Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.4

SRPM
python-lxml-4.2.3-2.el8.src.rpm SHA-256: 980b0120d96a2bca820ea3381528eff509d8406caca6bf42404b0ce0a039c538
x86_64
python3-lxml-4.2.3-2.el8.x86_64.rpm SHA-256: 9fbd2bdce41676fd20996218494dde85c04171740ed42fe5d46e062319a83e8f
python3-lxml-debuginfo-4.2.3-2.el8.x86_64.rpm SHA-256: 8c726f2c46af1983dd20379a25677f3f14b4c23b0342ca752844bf2f9c543a73

Red Hat Enterprise Linux Server - AUS 8.6

SRPM
python-lxml-4.2.3-2.el8.src.rpm SHA-256: 980b0120d96a2bca820ea3381528eff509d8406caca6bf42404b0ce0a039c538
x86_64
python-lxml-debugsource-4.2.3-2.el8.x86_64.rpm SHA-256: 3bdef082cb6ece1732f84727e0833b2b78326c0f1b1198ecb7213bf66cf4ced7
python3-lxml-4.2.3-2.el8.x86_64.rpm SHA-256: 9fbd2bdce41676fd20996218494dde85c04171740ed42fe5d46e062319a83e8f
python3-lxml-debuginfo-4.2.3-2.el8.x86_64.rpm SHA-256: 8c726f2c46af1983dd20379a25677f3f14b4c23b0342ca752844bf2f9c543a73

Red Hat Enterprise Linux Server - AUS 8.4

SRPM
python-lxml-4.2.3-2.el8.src.rpm SHA-256: 980b0120d96a2bca820ea3381528eff509d8406caca6bf42404b0ce0a039c538
x86_64
python3-lxml-4.2.3-2.el8.x86_64.rpm SHA-256: 9fbd2bdce41676fd20996218494dde85c04171740ed42fe5d46e062319a83e8f
python3-lxml-debuginfo-4.2.3-2.el8.x86_64.rpm SHA-256: 8c726f2c46af1983dd20379a25677f3f14b4c23b0342ca752844bf2f9c543a73

Red Hat Enterprise Linux for IBM z Systems 8

SRPM
python-lxml-4.2.3-2.el8.src.rpm SHA-256: 980b0120d96a2bca820ea3381528eff509d8406caca6bf42404b0ce0a039c538
s390x
python-lxml-debugsource-4.2.3-2.el8.s390x.rpm SHA-256: 96da8ef6a9f834e897609fd8819744de99707bbbcbe395138016eb48e31bdd99
python3-lxml-4.2.3-2.el8.s390x.rpm SHA-256: 63ad6d2d56640674e10812023d9c1f1ec2e5fdd56a314125dcda55b68e6549df
python3-lxml-debuginfo-4.2.3-2.el8.s390x.rpm SHA-256: 560b9bfa94057115d2e353bfb4c6bb805985a9c3eae97e27b72a11275438a465

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.6

SRPM
python-lxml-4.2.3-2.el8.src.rpm SHA-256: 980b0120d96a2bca820ea3381528eff509d8406caca6bf42404b0ce0a039c538
s390x
python-lxml-debugsource-4.2.3-2.el8.s390x.rpm SHA-256: 96da8ef6a9f834e897609fd8819744de99707bbbcbe395138016eb48e31bdd99
python3-lxml-4.2.3-2.el8.s390x.rpm SHA-256: 63ad6d2d56640674e10812023d9c1f1ec2e5fdd56a314125dcda55b68e6549df
python3-lxml-debuginfo-4.2.3-2.el8.s390x.rpm SHA-256: 560b9bfa94057115d2e353bfb4c6bb805985a9c3eae97e27b72a11275438a465

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.4

SRPM
python-lxml-4.2.3-2.el8.src.rpm SHA-256: 980b0120d96a2bca820ea3381528eff509d8406caca6bf42404b0ce0a039c538
s390x
python3-lxml-4.2.3-2.el8.s390x.rpm SHA-256: 63ad6d2d56640674e10812023d9c1f1ec2e5fdd56a314125dcda55b68e6549df
python3-lxml-debuginfo-4.2.3-2.el8.s390x.rpm SHA-256: 560b9bfa94057115d2e353bfb4c6bb805985a9c3eae97e27b72a11275438a465

Red Hat Enterprise Linux for Power, little endian 8

SRPM
python-lxml-4.2.3-2.el8.src.rpm SHA-256: 980b0120d96a2bca820ea3381528eff509d8406caca6bf42404b0ce0a039c538
ppc64le
python-lxml-debugsource-4.2.3-2.el8.ppc64le.rpm SHA-256: 68196949af9c235df0dbae9ee7b0be0c2b059cd1be434f9ecc23ced3cc6778c4
python3-lxml-4.2.3-2.el8.ppc64le.rpm SHA-256: 5dc781f665d9f6b9c579a09034df4c3c964bdc421c0fbed9114c204c85aed8bd
python3-lxml-debuginfo-4.2.3-2.el8.ppc64le.rpm SHA-256: c7994c770610a119674fadcc8bbc7f9bf08c9a49873b589b841c334cacf6e7aa

Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.6

SRPM
python-lxml-4.2.3-2.el8.src.rpm SHA-256: 980b0120d96a2bca820ea3381528eff509d8406caca6bf42404b0ce0a039c538
ppc64le
python-lxml-debugsource-4.2.3-2.el8.ppc64le.rpm SHA-256: 68196949af9c235df0dbae9ee7b0be0c2b059cd1be434f9ecc23ced3cc6778c4
python3-lxml-4.2.3-2.el8.ppc64le.rpm SHA-256: 5dc781f665d9f6b9c579a09034df4c3c964bdc421c0fbed9114c204c85aed8bd
python3-lxml-debuginfo-4.2.3-2.el8.ppc64le.rpm SHA-256: c7994c770610a119674fadcc8bbc7f9bf08c9a49873b589b841c334cacf6e7aa

Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.4

SRPM
python-lxml-4.2.3-2.el8.src.rpm SHA-256: 980b0120d96a2bca820ea3381528eff509d8406caca6bf42404b0ce0a039c538
ppc64le
python3-lxml-4.2.3-2.el8.ppc64le.rpm SHA-256: 5dc781f665d9f6b9c579a09034df4c3c964bdc421c0fbed9114c204c85aed8bd
python3-lxml-debuginfo-4.2.3-2.el8.ppc64le.rpm SHA-256: c7994c770610a119674fadcc8bbc7f9bf08c9a49873b589b841c334cacf6e7aa

Red Hat Enterprise Linux Server - TUS 8.6

SRPM
python-lxml-4.2.3-2.el8.src.rpm SHA-256: 980b0120d96a2bca820ea3381528eff509d8406caca6bf42404b0ce0a039c538
x86_64
python-lxml-debugsource-4.2.3-2.el8.x86_64.rpm SHA-256: 3bdef082cb6ece1732f84727e0833b2b78326c0f1b1198ecb7213bf66cf4ced7
python3-lxml-4.2.3-2.el8.x86_64.rpm SHA-256: 9fbd2bdce41676fd20996218494dde85c04171740ed42fe5d46e062319a83e8f
python3-lxml-debuginfo-4.2.3-2.el8.x86_64.rpm SHA-256: 8c726f2c46af1983dd20379a25677f3f14b4c23b0342ca752844bf2f9c543a73

Red Hat Enterprise Linux Server - TUS 8.4

SRPM
python-lxml-4.2.3-2.el8.src.rpm SHA-256: 980b0120d96a2bca820ea3381528eff509d8406caca6bf42404b0ce0a039c538
x86_64
python3-lxml-4.2.3-2.el8.x86_64.rpm SHA-256: 9fbd2bdce41676fd20996218494dde85c04171740ed42fe5d46e062319a83e8f
python3-lxml-debuginfo-4.2.3-2.el8.x86_64.rpm SHA-256: 8c726f2c46af1983dd20379a25677f3f14b4c23b0342ca752844bf2f9c543a73

Red Hat Enterprise Linux for ARM 64 8

SRPM
python-lxml-4.2.3-2.el8.src.rpm SHA-256: 980b0120d96a2bca820ea3381528eff509d8406caca6bf42404b0ce0a039c538
aarch64
python-lxml-debugsource-4.2.3-2.el8.aarch64.rpm SHA-256: 29ca32d567f28b6f2158c205232a553605bd28cf3fb8d30621645221d4a74a97
python3-lxml-4.2.3-2.el8.aarch64.rpm SHA-256: d6dc713ea16c9d73a1956d8f7ff8f6cb0df97dea67fa46a2f935c09044f1d89f
python3-lxml-debuginfo-4.2.3-2.el8.aarch64.rpm SHA-256: ca6feddc246b8ffeab3286cdf7a422c021963716d0c2af2e729a6b96502566c1

Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.6

SRPM
python-lxml-4.2.3-2.el8.src.rpm SHA-256: 980b0120d96a2bca820ea3381528eff509d8406caca6bf42404b0ce0a039c538
aarch64
python-lxml-debugsource-4.2.3-2.el8.aarch64.rpm SHA-256: 29ca32d567f28b6f2158c205232a553605bd28cf3fb8d30621645221d4a74a97
python3-lxml-4.2.3-2.el8.aarch64.rpm SHA-256: d6dc713ea16c9d73a1956d8f7ff8f6cb0df97dea67fa46a2f935c09044f1d89f
python3-lxml-debuginfo-4.2.3-2.el8.aarch64.rpm SHA-256: ca6feddc246b8ffeab3286cdf7a422c021963716d0c2af2e729a6b96502566c1

Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.4

SRPM
python-lxml-4.2.3-2.el8.src.rpm SHA-256: 980b0120d96a2bca820ea3381528eff509d8406caca6bf42404b0ce0a039c538
aarch64
python3-lxml-4.2.3-2.el8.aarch64.rpm SHA-256: d6dc713ea16c9d73a1956d8f7ff8f6cb0df97dea67fa46a2f935c09044f1d89f
python3-lxml-debuginfo-4.2.3-2.el8.aarch64.rpm SHA-256: ca6feddc246b8ffeab3286cdf7a422c021963716d0c2af2e729a6b96502566c1

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.6

SRPM
python-lxml-4.2.3-2.el8.src.rpm SHA-256: 980b0120d96a2bca820ea3381528eff509d8406caca6bf42404b0ce0a039c538
ppc64le
python-lxml-debugsource-4.2.3-2.el8.ppc64le.rpm SHA-256: 68196949af9c235df0dbae9ee7b0be0c2b059cd1be434f9ecc23ced3cc6778c4
python3-lxml-4.2.3-2.el8.ppc64le.rpm SHA-256: 5dc781f665d9f6b9c579a09034df4c3c964bdc421c0fbed9114c204c85aed8bd
python3-lxml-debuginfo-4.2.3-2.el8.ppc64le.rpm SHA-256: c7994c770610a119674fadcc8bbc7f9bf08c9a49873b589b841c334cacf6e7aa

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.4

SRPM
python-lxml-4.2.3-2.el8.src.rpm SHA-256: 980b0120d96a2bca820ea3381528eff509d8406caca6bf42404b0ce0a039c538
ppc64le
python3-lxml-4.2.3-2.el8.ppc64le.rpm SHA-256: 5dc781f665d9f6b9c579a09034df4c3c964bdc421c0fbed9114c204c85aed8bd
python3-lxml-debuginfo-4.2.3-2.el8.ppc64le.rpm SHA-256: c7994c770610a119674fadcc8bbc7f9bf08c9a49873b589b841c334cacf6e7aa

Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.6

SRPM
python-lxml-4.2.3-2.el8.src.rpm SHA-256: 980b0120d96a2bca820ea3381528eff509d8406caca6bf42404b0ce0a039c538
x86_64
python-lxml-debugsource-4.2.3-2.el8.x86_64.rpm SHA-256: 3bdef082cb6ece1732f84727e0833b2b78326c0f1b1198ecb7213bf66cf4ced7
python3-lxml-4.2.3-2.el8.x86_64.rpm SHA-256: 9fbd2bdce41676fd20996218494dde85c04171740ed42fe5d46e062319a83e8f
python3-lxml-debuginfo-4.2.3-2.el8.x86_64.rpm SHA-256: 8c726f2c46af1983dd20379a25677f3f14b4c23b0342ca752844bf2f9c543a73

Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.4

SRPM
python-lxml-4.2.3-2.el8.src.rpm SHA-256: 980b0120d96a2bca820ea3381528eff509d8406caca6bf42404b0ce0a039c538
x86_64
python3-lxml-4.2.3-2.el8.x86_64.rpm SHA-256: 9fbd2bdce41676fd20996218494dde85c04171740ed42fe5d46e062319a83e8f
python3-lxml-debuginfo-4.2.3-2.el8.x86_64.rpm SHA-256: 8c726f2c46af1983dd20379a25677f3f14b4c23b0342ca752844bf2f9c543a73

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.