Red Hat Product Errata RHSA-2021:4158 - Security Advisory
Issued:
2021-11-09
Updated:
2021-11-09

RHSA-2021:4158 - Security Advisory

Synopsis

Moderate: python-lxml security update

Type/Severity

Security Advisory: Moderate

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for python-lxml is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

lxml is an XML processing library providing access to libxml2 and libxslt libraries using the Python ElementTree API.

Security Fix(es):

  • python-lxml: Missing input sanitization for formaction HTML5 attributes may lead to XSS (CVE-2021-28957)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.5 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 8 x86_64
  • Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.8 x86_64
  • Red Hat Enterprise Linux for x86_64 - Extended Update Support Extension 8.8 x86_64
  • Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.6 x86_64
  • Red Hat Enterprise Linux for x86_64 - Extended Update Support Extension 8.6 x86_64
  • Red Hat Enterprise Linux Server - AUS 8.6 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 8 s390x
  • Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.8 s390x
  • Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.6 s390x
  • Red Hat Enterprise Linux for Power, little endian 8 ppc64le
  • Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.8 ppc64le
  • Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.6 ppc64le
  • Red Hat Enterprise Linux Server - TUS 8.8 x86_64
  • Red Hat Enterprise Linux Server - TUS 8.6 x86_64
  • Red Hat Enterprise Linux for ARM 64 8 aarch64
  • Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.8 aarch64
  • Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.6 aarch64
  • Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.8 ppc64le
  • Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.6 ppc64le
  • Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.8 x86_64
  • Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.6 x86_64

Fixes

  • BZ - 1941534 - CVE-2021-28957 python-lxml: Missing input sanitization for formaction HTML5 attributes may lead to XSS

Red Hat Enterprise Linux for x86_64 8

SRPM
python-lxml-4.2.3-3.el8.src.rpm SHA-256: a39c69217be228ae25344b8a412c47f79810cce22517f87cca68192de41e5ec8
x86_64
python-lxml-debugsource-4.2.3-3.el8.x86_64.rpm SHA-256: 70201fedf7b86366514b7f2158ad6c3bc287fdb14524586a38aa7b57f16e2753
python3-lxml-4.2.3-3.el8.x86_64.rpm SHA-256: 7fa6f77489c4a689cc2cb37189f088c94380c42b8cef40c570f6bdc2562ff332
python3-lxml-debuginfo-4.2.3-3.el8.x86_64.rpm SHA-256: 06e600478c9e6256b472f677c498b9eb9197cd32e4e3d9a0f200de17d4a321b8

Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.8

SRPM
python-lxml-4.2.3-3.el8.src.rpm SHA-256: a39c69217be228ae25344b8a412c47f79810cce22517f87cca68192de41e5ec8
x86_64
python-lxml-debugsource-4.2.3-3.el8.x86_64.rpm SHA-256: 70201fedf7b86366514b7f2158ad6c3bc287fdb14524586a38aa7b57f16e2753
python3-lxml-4.2.3-3.el8.x86_64.rpm SHA-256: 7fa6f77489c4a689cc2cb37189f088c94380c42b8cef40c570f6bdc2562ff332
python3-lxml-debuginfo-4.2.3-3.el8.x86_64.rpm SHA-256: 06e600478c9e6256b472f677c498b9eb9197cd32e4e3d9a0f200de17d4a321b8

Red Hat Enterprise Linux for x86_64 - Extended Update Support Extension 8.8

SRPM
python-lxml-4.2.3-3.el8.src.rpm SHA-256: a39c69217be228ae25344b8a412c47f79810cce22517f87cca68192de41e5ec8
x86_64
python-lxml-debugsource-4.2.3-3.el8.x86_64.rpm SHA-256: 70201fedf7b86366514b7f2158ad6c3bc287fdb14524586a38aa7b57f16e2753
python3-lxml-4.2.3-3.el8.x86_64.rpm SHA-256: 7fa6f77489c4a689cc2cb37189f088c94380c42b8cef40c570f6bdc2562ff332
python3-lxml-debuginfo-4.2.3-3.el8.x86_64.rpm SHA-256: 06e600478c9e6256b472f677c498b9eb9197cd32e4e3d9a0f200de17d4a321b8

Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.6

SRPM
python-lxml-4.2.3-3.el8.src.rpm SHA-256: a39c69217be228ae25344b8a412c47f79810cce22517f87cca68192de41e5ec8
x86_64
python-lxml-debugsource-4.2.3-3.el8.x86_64.rpm SHA-256: 70201fedf7b86366514b7f2158ad6c3bc287fdb14524586a38aa7b57f16e2753
python3-lxml-4.2.3-3.el8.x86_64.rpm SHA-256: 7fa6f77489c4a689cc2cb37189f088c94380c42b8cef40c570f6bdc2562ff332
python3-lxml-debuginfo-4.2.3-3.el8.x86_64.rpm SHA-256: 06e600478c9e6256b472f677c498b9eb9197cd32e4e3d9a0f200de17d4a321b8

Red Hat Enterprise Linux for x86_64 - Extended Update Support Extension 8.6

SRPM
python-lxml-4.2.3-3.el8.src.rpm SHA-256: a39c69217be228ae25344b8a412c47f79810cce22517f87cca68192de41e5ec8
x86_64
python-lxml-debugsource-4.2.3-3.el8.x86_64.rpm SHA-256: 70201fedf7b86366514b7f2158ad6c3bc287fdb14524586a38aa7b57f16e2753
python3-lxml-4.2.3-3.el8.x86_64.rpm SHA-256: 7fa6f77489c4a689cc2cb37189f088c94380c42b8cef40c570f6bdc2562ff332
python3-lxml-debuginfo-4.2.3-3.el8.x86_64.rpm SHA-256: 06e600478c9e6256b472f677c498b9eb9197cd32e4e3d9a0f200de17d4a321b8

Red Hat Enterprise Linux Server - AUS 8.6

SRPM
python-lxml-4.2.3-3.el8.src.rpm SHA-256: a39c69217be228ae25344b8a412c47f79810cce22517f87cca68192de41e5ec8
x86_64
python-lxml-debugsource-4.2.3-3.el8.x86_64.rpm SHA-256: 70201fedf7b86366514b7f2158ad6c3bc287fdb14524586a38aa7b57f16e2753
python3-lxml-4.2.3-3.el8.x86_64.rpm SHA-256: 7fa6f77489c4a689cc2cb37189f088c94380c42b8cef40c570f6bdc2562ff332
python3-lxml-debuginfo-4.2.3-3.el8.x86_64.rpm SHA-256: 06e600478c9e6256b472f677c498b9eb9197cd32e4e3d9a0f200de17d4a321b8

Red Hat Enterprise Linux for IBM z Systems 8

SRPM
python-lxml-4.2.3-3.el8.src.rpm SHA-256: a39c69217be228ae25344b8a412c47f79810cce22517f87cca68192de41e5ec8
s390x
python-lxml-debugsource-4.2.3-3.el8.s390x.rpm SHA-256: 5ef576690f271de7adf0be2c189292078b6e3638f16514848976a36c1156fd47
python3-lxml-4.2.3-3.el8.s390x.rpm SHA-256: b5e9017691f01451371636b44cca4f260ffedda407797e6ea7ffd3303f4cf0e9
python3-lxml-debuginfo-4.2.3-3.el8.s390x.rpm SHA-256: c6ce092b874ce33289a74ae8c6c1991b99c4c443c8f998f8811f5994f4a71925

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.8

SRPM
python-lxml-4.2.3-3.el8.src.rpm SHA-256: a39c69217be228ae25344b8a412c47f79810cce22517f87cca68192de41e5ec8
s390x
python-lxml-debugsource-4.2.3-3.el8.s390x.rpm SHA-256: 5ef576690f271de7adf0be2c189292078b6e3638f16514848976a36c1156fd47
python3-lxml-4.2.3-3.el8.s390x.rpm SHA-256: b5e9017691f01451371636b44cca4f260ffedda407797e6ea7ffd3303f4cf0e9
python3-lxml-debuginfo-4.2.3-3.el8.s390x.rpm SHA-256: c6ce092b874ce33289a74ae8c6c1991b99c4c443c8f998f8811f5994f4a71925

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.6

SRPM
python-lxml-4.2.3-3.el8.src.rpm SHA-256: a39c69217be228ae25344b8a412c47f79810cce22517f87cca68192de41e5ec8
s390x
python-lxml-debugsource-4.2.3-3.el8.s390x.rpm SHA-256: 5ef576690f271de7adf0be2c189292078b6e3638f16514848976a36c1156fd47
python3-lxml-4.2.3-3.el8.s390x.rpm SHA-256: b5e9017691f01451371636b44cca4f260ffedda407797e6ea7ffd3303f4cf0e9
python3-lxml-debuginfo-4.2.3-3.el8.s390x.rpm SHA-256: c6ce092b874ce33289a74ae8c6c1991b99c4c443c8f998f8811f5994f4a71925

Red Hat Enterprise Linux for Power, little endian 8

SRPM
python-lxml-4.2.3-3.el8.src.rpm SHA-256: a39c69217be228ae25344b8a412c47f79810cce22517f87cca68192de41e5ec8
ppc64le
python-lxml-debugsource-4.2.3-3.el8.ppc64le.rpm SHA-256: 3f2cc0a95ab0ba4be3b6feb4911a4a653c7fc622a1a3bd49412f8473f9544170
python3-lxml-4.2.3-3.el8.ppc64le.rpm SHA-256: 8ce1f5e50692b55bfa7e8485238c67135b1a7eca4265116d4324b2691ae58587
python3-lxml-debuginfo-4.2.3-3.el8.ppc64le.rpm SHA-256: 098dfcd3e852cf5ca4501ed20772f595d3f4a2e8fa829dc52bb1c1b6f03ba5e8

Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.8

SRPM
python-lxml-4.2.3-3.el8.src.rpm SHA-256: a39c69217be228ae25344b8a412c47f79810cce22517f87cca68192de41e5ec8
ppc64le
python-lxml-debugsource-4.2.3-3.el8.ppc64le.rpm SHA-256: 3f2cc0a95ab0ba4be3b6feb4911a4a653c7fc622a1a3bd49412f8473f9544170
python3-lxml-4.2.3-3.el8.ppc64le.rpm SHA-256: 8ce1f5e50692b55bfa7e8485238c67135b1a7eca4265116d4324b2691ae58587
python3-lxml-debuginfo-4.2.3-3.el8.ppc64le.rpm SHA-256: 098dfcd3e852cf5ca4501ed20772f595d3f4a2e8fa829dc52bb1c1b6f03ba5e8

Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.6

SRPM
python-lxml-4.2.3-3.el8.src.rpm SHA-256: a39c69217be228ae25344b8a412c47f79810cce22517f87cca68192de41e5ec8
ppc64le
python-lxml-debugsource-4.2.3-3.el8.ppc64le.rpm SHA-256: 3f2cc0a95ab0ba4be3b6feb4911a4a653c7fc622a1a3bd49412f8473f9544170
python3-lxml-4.2.3-3.el8.ppc64le.rpm SHA-256: 8ce1f5e50692b55bfa7e8485238c67135b1a7eca4265116d4324b2691ae58587
python3-lxml-debuginfo-4.2.3-3.el8.ppc64le.rpm SHA-256: 098dfcd3e852cf5ca4501ed20772f595d3f4a2e8fa829dc52bb1c1b6f03ba5e8

Red Hat Enterprise Linux Server - TUS 8.8

SRPM
python-lxml-4.2.3-3.el8.src.rpm SHA-256: a39c69217be228ae25344b8a412c47f79810cce22517f87cca68192de41e5ec8
x86_64
python-lxml-debugsource-4.2.3-3.el8.x86_64.rpm SHA-256: 70201fedf7b86366514b7f2158ad6c3bc287fdb14524586a38aa7b57f16e2753
python3-lxml-4.2.3-3.el8.x86_64.rpm SHA-256: 7fa6f77489c4a689cc2cb37189f088c94380c42b8cef40c570f6bdc2562ff332
python3-lxml-debuginfo-4.2.3-3.el8.x86_64.rpm SHA-256: 06e600478c9e6256b472f677c498b9eb9197cd32e4e3d9a0f200de17d4a321b8

Red Hat Enterprise Linux Server - TUS 8.6

SRPM
python-lxml-4.2.3-3.el8.src.rpm SHA-256: a39c69217be228ae25344b8a412c47f79810cce22517f87cca68192de41e5ec8
x86_64
python-lxml-debugsource-4.2.3-3.el8.x86_64.rpm SHA-256: 70201fedf7b86366514b7f2158ad6c3bc287fdb14524586a38aa7b57f16e2753
python3-lxml-4.2.3-3.el8.x86_64.rpm SHA-256: 7fa6f77489c4a689cc2cb37189f088c94380c42b8cef40c570f6bdc2562ff332
python3-lxml-debuginfo-4.2.3-3.el8.x86_64.rpm SHA-256: 06e600478c9e6256b472f677c498b9eb9197cd32e4e3d9a0f200de17d4a321b8

Red Hat Enterprise Linux for ARM 64 8

SRPM
python-lxml-4.2.3-3.el8.src.rpm SHA-256: a39c69217be228ae25344b8a412c47f79810cce22517f87cca68192de41e5ec8
aarch64
python-lxml-debugsource-4.2.3-3.el8.aarch64.rpm SHA-256: a0d512874d2fa8f3d34b2bba93791d08e659ddea121de95a2ef4552c8ccb3da4
python3-lxml-4.2.3-3.el8.aarch64.rpm SHA-256: ba4b6baa4a475115c2ea7ea91c1e037d874924dce01e586531b93cdd769feb02
python3-lxml-debuginfo-4.2.3-3.el8.aarch64.rpm SHA-256: 42d1f03d522dc56b9dd968c0714e0fba931bb691b92aeb574e930527598c321c

Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.8

SRPM
python-lxml-4.2.3-3.el8.src.rpm SHA-256: a39c69217be228ae25344b8a412c47f79810cce22517f87cca68192de41e5ec8
aarch64
python-lxml-debugsource-4.2.3-3.el8.aarch64.rpm SHA-256: a0d512874d2fa8f3d34b2bba93791d08e659ddea121de95a2ef4552c8ccb3da4
python3-lxml-4.2.3-3.el8.aarch64.rpm SHA-256: ba4b6baa4a475115c2ea7ea91c1e037d874924dce01e586531b93cdd769feb02
python3-lxml-debuginfo-4.2.3-3.el8.aarch64.rpm SHA-256: 42d1f03d522dc56b9dd968c0714e0fba931bb691b92aeb574e930527598c321c

Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.6

SRPM
python-lxml-4.2.3-3.el8.src.rpm SHA-256: a39c69217be228ae25344b8a412c47f79810cce22517f87cca68192de41e5ec8
aarch64
python-lxml-debugsource-4.2.3-3.el8.aarch64.rpm SHA-256: a0d512874d2fa8f3d34b2bba93791d08e659ddea121de95a2ef4552c8ccb3da4
python3-lxml-4.2.3-3.el8.aarch64.rpm SHA-256: ba4b6baa4a475115c2ea7ea91c1e037d874924dce01e586531b93cdd769feb02
python3-lxml-debuginfo-4.2.3-3.el8.aarch64.rpm SHA-256: 42d1f03d522dc56b9dd968c0714e0fba931bb691b92aeb574e930527598c321c

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.8

SRPM
python-lxml-4.2.3-3.el8.src.rpm SHA-256: a39c69217be228ae25344b8a412c47f79810cce22517f87cca68192de41e5ec8
ppc64le
python-lxml-debugsource-4.2.3-3.el8.ppc64le.rpm SHA-256: 3f2cc0a95ab0ba4be3b6feb4911a4a653c7fc622a1a3bd49412f8473f9544170
python3-lxml-4.2.3-3.el8.ppc64le.rpm SHA-256: 8ce1f5e50692b55bfa7e8485238c67135b1a7eca4265116d4324b2691ae58587
python3-lxml-debuginfo-4.2.3-3.el8.ppc64le.rpm SHA-256: 098dfcd3e852cf5ca4501ed20772f595d3f4a2e8fa829dc52bb1c1b6f03ba5e8

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.6

SRPM
python-lxml-4.2.3-3.el8.src.rpm SHA-256: a39c69217be228ae25344b8a412c47f79810cce22517f87cca68192de41e5ec8
ppc64le
python-lxml-debugsource-4.2.3-3.el8.ppc64le.rpm SHA-256: 3f2cc0a95ab0ba4be3b6feb4911a4a653c7fc622a1a3bd49412f8473f9544170
python3-lxml-4.2.3-3.el8.ppc64le.rpm SHA-256: 8ce1f5e50692b55bfa7e8485238c67135b1a7eca4265116d4324b2691ae58587
python3-lxml-debuginfo-4.2.3-3.el8.ppc64le.rpm SHA-256: 098dfcd3e852cf5ca4501ed20772f595d3f4a2e8fa829dc52bb1c1b6f03ba5e8

Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.8

SRPM
python-lxml-4.2.3-3.el8.src.rpm SHA-256: a39c69217be228ae25344b8a412c47f79810cce22517f87cca68192de41e5ec8
x86_64
python-lxml-debugsource-4.2.3-3.el8.x86_64.rpm SHA-256: 70201fedf7b86366514b7f2158ad6c3bc287fdb14524586a38aa7b57f16e2753
python3-lxml-4.2.3-3.el8.x86_64.rpm SHA-256: 7fa6f77489c4a689cc2cb37189f088c94380c42b8cef40c570f6bdc2562ff332
python3-lxml-debuginfo-4.2.3-3.el8.x86_64.rpm SHA-256: 06e600478c9e6256b472f677c498b9eb9197cd32e4e3d9a0f200de17d4a321b8

Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.6

SRPM
python-lxml-4.2.3-3.el8.src.rpm SHA-256: a39c69217be228ae25344b8a412c47f79810cce22517f87cca68192de41e5ec8
x86_64
python-lxml-debugsource-4.2.3-3.el8.x86_64.rpm SHA-256: 70201fedf7b86366514b7f2158ad6c3bc287fdb14524586a38aa7b57f16e2753
python3-lxml-4.2.3-3.el8.x86_64.rpm SHA-256: 7fa6f77489c4a689cc2cb37189f088c94380c42b8cef40c570f6bdc2562ff332
python3-lxml-debuginfo-4.2.3-3.el8.x86_64.rpm SHA-256: 06e600478c9e6256b472f677c498b9eb9197cd32e4e3d9a0f200de17d4a321b8

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.