Issued:: 2022-05-10
Updated:: 2022-05-10

RHSA-2022:1932 - Security Advisory

Overview
Updated Packages

Synopsis

Moderate: python-lxml security update

Type/Severity

Security Advisory: Moderate

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for python-lxml is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

lxml is an XML processing library providing access to libxml2 and libxslt libraries using the Python ElementTree API.

Security Fix(es):

python-lxml: HTML Cleaner allows crafted and SVG embedded scripts to pass through (CVE-2021-43818)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.6 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

Red Hat Enterprise Linux for x86_64 8 x86_64
Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.8 x86_64
Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.6 x86_64
Red Hat Enterprise Linux Server - AUS 8.6 x86_64
Red Hat Enterprise Linux for IBM z Systems 8 s390x
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.8 s390x
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.6 s390x
Red Hat Enterprise Linux for Power, little endian 8 ppc64le
Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.8 ppc64le
Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.6 ppc64le
Red Hat Enterprise Linux Server - TUS 8.8 x86_64
Red Hat Enterprise Linux Server - TUS 8.6 x86_64
Red Hat Enterprise Linux for ARM 64 8 aarch64
Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.8 aarch64
Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.6 aarch64
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.8 ppc64le
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.6 ppc64le
Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.8 x86_64
Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.6 x86_64

Fixes

BZ - 2032569 - CVE-2021-43818 python-lxml: HTML Cleaner allows crafted and SVG embedded scripts to pass through

CVEs

CVE-2021-43818

References

Note: More recent versions of these packages may be available. Click a package name for more details.

Red Hat Enterprise Linux for x86_64 8

SRPM
python-lxml-4.2.3-4.el8.src.rpm	SHA-256: 44eab5f6b9bef9f70b3043eda76f730b2ccae6a9371bc41213667b970712975c
x86_64
python-lxml-debugsource-4.2.3-4.el8.x86_64.rpm	SHA-256: 85fb02c95e590fc4be29651e517e73cf8c33992942f1942f159bbc2bf4480c54
python3-lxml-4.2.3-4.el8.x86_64.rpm	SHA-256: 9d44aa71f33960ce96e66ee5b42dc12a00edbdb9450e9c7787550a7facb96552
python3-lxml-debuginfo-4.2.3-4.el8.x86_64.rpm	SHA-256: 42f96e8ffba1c8d5373a0294469d9712b56061c825c16c83a73103a55df0ab6d

Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.8

SRPM
python-lxml-4.2.3-4.el8.src.rpm	SHA-256: 44eab5f6b9bef9f70b3043eda76f730b2ccae6a9371bc41213667b970712975c
x86_64
python-lxml-debugsource-4.2.3-4.el8.x86_64.rpm	SHA-256: 85fb02c95e590fc4be29651e517e73cf8c33992942f1942f159bbc2bf4480c54
python3-lxml-4.2.3-4.el8.x86_64.rpm	SHA-256: 9d44aa71f33960ce96e66ee5b42dc12a00edbdb9450e9c7787550a7facb96552
python3-lxml-debuginfo-4.2.3-4.el8.x86_64.rpm	SHA-256: 42f96e8ffba1c8d5373a0294469d9712b56061c825c16c83a73103a55df0ab6d

Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.6

SRPM
python-lxml-4.2.3-4.el8.src.rpm	SHA-256: 44eab5f6b9bef9f70b3043eda76f730b2ccae6a9371bc41213667b970712975c
x86_64
python3-lxml-4.2.3-4.el8.x86_64.rpm	SHA-256: 9d44aa71f33960ce96e66ee5b42dc12a00edbdb9450e9c7787550a7facb96552
python3-lxml-debuginfo-4.2.3-4.el8.x86_64.rpm	SHA-256: 42f96e8ffba1c8d5373a0294469d9712b56061c825c16c83a73103a55df0ab6d

Red Hat Enterprise Linux Server - AUS 8.6

SRPM
python-lxml-4.2.3-4.el8.src.rpm	SHA-256: 44eab5f6b9bef9f70b3043eda76f730b2ccae6a9371bc41213667b970712975c
x86_64
python3-lxml-4.2.3-4.el8.x86_64.rpm	SHA-256: 9d44aa71f33960ce96e66ee5b42dc12a00edbdb9450e9c7787550a7facb96552
python3-lxml-debuginfo-4.2.3-4.el8.x86_64.rpm	SHA-256: 42f96e8ffba1c8d5373a0294469d9712b56061c825c16c83a73103a55df0ab6d

Red Hat Enterprise Linux for IBM z Systems 8

SRPM
python-lxml-4.2.3-4.el8.src.rpm	SHA-256: 44eab5f6b9bef9f70b3043eda76f730b2ccae6a9371bc41213667b970712975c
s390x
python-lxml-debugsource-4.2.3-4.el8.s390x.rpm	SHA-256: 2a4121d4b347a78827309028951eb76c9229cef2cfa0cd985aed6a4ef8ba2a0e
python3-lxml-4.2.3-4.el8.s390x.rpm	SHA-256: 30926d8be2602fa2170282488ac4cc071028463c823e1dfafaaf9b4c2200b00e
python3-lxml-debuginfo-4.2.3-4.el8.s390x.rpm	SHA-256: 3e09211c9e43bdd6c261a58d719a8e94de05ea57692fde73f2b5a99746f187b1

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.8

SRPM
python-lxml-4.2.3-4.el8.src.rpm	SHA-256: 44eab5f6b9bef9f70b3043eda76f730b2ccae6a9371bc41213667b970712975c
s390x
python-lxml-debugsource-4.2.3-4.el8.s390x.rpm	SHA-256: 2a4121d4b347a78827309028951eb76c9229cef2cfa0cd985aed6a4ef8ba2a0e
python3-lxml-4.2.3-4.el8.s390x.rpm	SHA-256: 30926d8be2602fa2170282488ac4cc071028463c823e1dfafaaf9b4c2200b00e
python3-lxml-debuginfo-4.2.3-4.el8.s390x.rpm	SHA-256: 3e09211c9e43bdd6c261a58d719a8e94de05ea57692fde73f2b5a99746f187b1

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.6

SRPM
python-lxml-4.2.3-4.el8.src.rpm	SHA-256: 44eab5f6b9bef9f70b3043eda76f730b2ccae6a9371bc41213667b970712975c
s390x
python3-lxml-4.2.3-4.el8.s390x.rpm	SHA-256: 30926d8be2602fa2170282488ac4cc071028463c823e1dfafaaf9b4c2200b00e
python3-lxml-debuginfo-4.2.3-4.el8.s390x.rpm	SHA-256: 3e09211c9e43bdd6c261a58d719a8e94de05ea57692fde73f2b5a99746f187b1

Red Hat Enterprise Linux for Power, little endian 8

SRPM
python-lxml-4.2.3-4.el8.src.rpm	SHA-256: 44eab5f6b9bef9f70b3043eda76f730b2ccae6a9371bc41213667b970712975c
ppc64le
python-lxml-debugsource-4.2.3-4.el8.ppc64le.rpm	SHA-256: 8c0f1d06b320ff6f1baee5ee0948be6a6de786e12e4f4c0b13252704669b81d1
python3-lxml-4.2.3-4.el8.ppc64le.rpm	SHA-256: 7df9a2d88cb3aaaeb9c4a498e77f223719271e26a65b5c1a5ef4bc0a5a1734ed
python3-lxml-debuginfo-4.2.3-4.el8.ppc64le.rpm	SHA-256: d6379a8fe30a63e2de2738660356789f6b52e651ab3a51d2d80aa3cfa977bb26

Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.8

SRPM
python-lxml-4.2.3-4.el8.src.rpm	SHA-256: 44eab5f6b9bef9f70b3043eda76f730b2ccae6a9371bc41213667b970712975c
ppc64le
python-lxml-debugsource-4.2.3-4.el8.ppc64le.rpm	SHA-256: 8c0f1d06b320ff6f1baee5ee0948be6a6de786e12e4f4c0b13252704669b81d1
python3-lxml-4.2.3-4.el8.ppc64le.rpm	SHA-256: 7df9a2d88cb3aaaeb9c4a498e77f223719271e26a65b5c1a5ef4bc0a5a1734ed
python3-lxml-debuginfo-4.2.3-4.el8.ppc64le.rpm	SHA-256: d6379a8fe30a63e2de2738660356789f6b52e651ab3a51d2d80aa3cfa977bb26

Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.6

SRPM
python-lxml-4.2.3-4.el8.src.rpm	SHA-256: 44eab5f6b9bef9f70b3043eda76f730b2ccae6a9371bc41213667b970712975c
ppc64le
python3-lxml-4.2.3-4.el8.ppc64le.rpm	SHA-256: 7df9a2d88cb3aaaeb9c4a498e77f223719271e26a65b5c1a5ef4bc0a5a1734ed
python3-lxml-debuginfo-4.2.3-4.el8.ppc64le.rpm	SHA-256: d6379a8fe30a63e2de2738660356789f6b52e651ab3a51d2d80aa3cfa977bb26

Red Hat Enterprise Linux Server - TUS 8.8

SRPM
python-lxml-4.2.3-4.el8.src.rpm	SHA-256: 44eab5f6b9bef9f70b3043eda76f730b2ccae6a9371bc41213667b970712975c
x86_64
python-lxml-debugsource-4.2.3-4.el8.x86_64.rpm	SHA-256: 85fb02c95e590fc4be29651e517e73cf8c33992942f1942f159bbc2bf4480c54
python3-lxml-4.2.3-4.el8.x86_64.rpm	SHA-256: 9d44aa71f33960ce96e66ee5b42dc12a00edbdb9450e9c7787550a7facb96552
python3-lxml-debuginfo-4.2.3-4.el8.x86_64.rpm	SHA-256: 42f96e8ffba1c8d5373a0294469d9712b56061c825c16c83a73103a55df0ab6d

Red Hat Enterprise Linux Server - TUS 8.6

SRPM
python-lxml-4.2.3-4.el8.src.rpm	SHA-256: 44eab5f6b9bef9f70b3043eda76f730b2ccae6a9371bc41213667b970712975c
x86_64
python3-lxml-4.2.3-4.el8.x86_64.rpm	SHA-256: 9d44aa71f33960ce96e66ee5b42dc12a00edbdb9450e9c7787550a7facb96552
python3-lxml-debuginfo-4.2.3-4.el8.x86_64.rpm	SHA-256: 42f96e8ffba1c8d5373a0294469d9712b56061c825c16c83a73103a55df0ab6d

Red Hat Enterprise Linux for ARM 64 8

SRPM
python-lxml-4.2.3-4.el8.src.rpm	SHA-256: 44eab5f6b9bef9f70b3043eda76f730b2ccae6a9371bc41213667b970712975c
aarch64
python-lxml-debugsource-4.2.3-4.el8.aarch64.rpm	SHA-256: 6a8aa2964c9f921838ca35daf67f2c3c635e3283973710a499938dcff1f2f194
python3-lxml-4.2.3-4.el8.aarch64.rpm	SHA-256: addd5172ae943ff79311f665b57570030823a0df42d283cdccf251a9b11c274c
python3-lxml-debuginfo-4.2.3-4.el8.aarch64.rpm	SHA-256: a4f91b22405ee50d7a1e792be02fddb59f7e46b8de63afd3fa59392adf4209a0

Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.8

SRPM
python-lxml-4.2.3-4.el8.src.rpm	SHA-256: 44eab5f6b9bef9f70b3043eda76f730b2ccae6a9371bc41213667b970712975c
aarch64
python-lxml-debugsource-4.2.3-4.el8.aarch64.rpm	SHA-256: 6a8aa2964c9f921838ca35daf67f2c3c635e3283973710a499938dcff1f2f194
python3-lxml-4.2.3-4.el8.aarch64.rpm	SHA-256: addd5172ae943ff79311f665b57570030823a0df42d283cdccf251a9b11c274c
python3-lxml-debuginfo-4.2.3-4.el8.aarch64.rpm	SHA-256: a4f91b22405ee50d7a1e792be02fddb59f7e46b8de63afd3fa59392adf4209a0

Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.6

SRPM
python-lxml-4.2.3-4.el8.src.rpm	SHA-256: 44eab5f6b9bef9f70b3043eda76f730b2ccae6a9371bc41213667b970712975c
aarch64
python3-lxml-4.2.3-4.el8.aarch64.rpm	SHA-256: addd5172ae943ff79311f665b57570030823a0df42d283cdccf251a9b11c274c
python3-lxml-debuginfo-4.2.3-4.el8.aarch64.rpm	SHA-256: a4f91b22405ee50d7a1e792be02fddb59f7e46b8de63afd3fa59392adf4209a0

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.8

SRPM
python-lxml-4.2.3-4.el8.src.rpm	SHA-256: 44eab5f6b9bef9f70b3043eda76f730b2ccae6a9371bc41213667b970712975c
ppc64le
python-lxml-debugsource-4.2.3-4.el8.ppc64le.rpm	SHA-256: 8c0f1d06b320ff6f1baee5ee0948be6a6de786e12e4f4c0b13252704669b81d1
python3-lxml-4.2.3-4.el8.ppc64le.rpm	SHA-256: 7df9a2d88cb3aaaeb9c4a498e77f223719271e26a65b5c1a5ef4bc0a5a1734ed
python3-lxml-debuginfo-4.2.3-4.el8.ppc64le.rpm	SHA-256: d6379a8fe30a63e2de2738660356789f6b52e651ab3a51d2d80aa3cfa977bb26

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.6

SRPM
python-lxml-4.2.3-4.el8.src.rpm	SHA-256: 44eab5f6b9bef9f70b3043eda76f730b2ccae6a9371bc41213667b970712975c
ppc64le
python3-lxml-4.2.3-4.el8.ppc64le.rpm	SHA-256: 7df9a2d88cb3aaaeb9c4a498e77f223719271e26a65b5c1a5ef4bc0a5a1734ed
python3-lxml-debuginfo-4.2.3-4.el8.ppc64le.rpm	SHA-256: d6379a8fe30a63e2de2738660356789f6b52e651ab3a51d2d80aa3cfa977bb26

Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.8

SRPM
python-lxml-4.2.3-4.el8.src.rpm	SHA-256: 44eab5f6b9bef9f70b3043eda76f730b2ccae6a9371bc41213667b970712975c
x86_64
python-lxml-debugsource-4.2.3-4.el8.x86_64.rpm	SHA-256: 85fb02c95e590fc4be29651e517e73cf8c33992942f1942f159bbc2bf4480c54
python3-lxml-4.2.3-4.el8.x86_64.rpm	SHA-256: 9d44aa71f33960ce96e66ee5b42dc12a00edbdb9450e9c7787550a7facb96552
python3-lxml-debuginfo-4.2.3-4.el8.x86_64.rpm	SHA-256: 42f96e8ffba1c8d5373a0294469d9712b56061c825c16c83a73103a55df0ab6d

Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.6

SRPM
python-lxml-4.2.3-4.el8.src.rpm	SHA-256: 44eab5f6b9bef9f70b3043eda76f730b2ccae6a9371bc41213667b970712975c
x86_64
python3-lxml-4.2.3-4.el8.x86_64.rpm	SHA-256: 9d44aa71f33960ce96e66ee5b42dc12a00edbdb9450e9c7787550a7facb96552
python3-lxml-debuginfo-4.2.3-4.el8.x86_64.rpm	SHA-256: 42f96e8ffba1c8d5373a0294469d9712b56061c825c16c83a73103a55df0ab6d

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.