PT-2018-18257 · None+1 · Bleach+1

Willkg · Publicado 2018-03-07 · Atualizado 2026-03-05 · CVE-2018-7753

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Bleach versions 2.1.x before 2.1.3

Description: An issue was discovered where attributes with URI values were not properly sanitized if the values contained character entities. This allowed for the construction of a URI value with a scheme that was not allowed to bypass sanitization.

Recommendations: For versions 2.1.x before 2.1.3, update to version 2.1.3 to resolve the issue.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2018-7753

GHSA-M9MQ-P2F9-CFQV

OPENSUSE-SU-2024:11219-1

OPENSUSE-SU-2024:14134-1

PYSEC-2018-51

USN-8077-1

Produtos afetados

Bleach

Ubuntu

Referências · 28

• https://github.com/mozilla/bleach/commit/c5df5789ec3471a31311f42c2d19fc2cf21b35ef · Correção
• https://github.com/mozilla/bleach/releases/tag/v2.1.3 · Nota
• https://github.com/mozilla/bleach/pull/356 · Nota
• https://github.com/mozilla/bleach · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/bleach/PYSEC-2018-51.yaml · Nota
• https://ubuntu.com/security/CVE-2020-6816 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2020-6816 · Nota
• https://github.com/advisories/GHSA-m9mq-p2f9-cfqv · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-7753 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2018-7753 · Nota
• https://ubuntu.com/security/CVE-2020-6817 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-7753 · Aviso do Fabricante
• https://bugs.debian.org/892252 · Nota
• https://suse.com/security/cve/CVE-2021-23980 · Nota
• https://security-tracker.debian.org/tracker/CVE-2018-7753 · Aviso do Fabricante