VDB
PYSEC-2018-51
PYSEC-2018-51
PUBLISHED
Record from OSV · Published March 7, 2018
bleach is fixed in c5df5789ec3471a31311f42c2d19fc2cf21b35ef and 2.1.3 (PyPI)
An issue was discovered in Bleach 2.1.x before 2.1.3. Attributes that have URI values weren't properly sanitized if the values contained character entities. Using character entities, it was possible to construct a URI value with a scheme that was not allowed that would slide through unsanitized.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| bleach | PyPI | c5df5789ec3471a31311f42c2d19fc2cf21b35ef, 2.1.3 |
Affected products
| Vendor | Product | Versions |
|---|---|---|
| PyPI | bleach | 0, 2.1, 2.1.2 |
Timeline
- Mar 7, 2018 CVE Published
- Nov 8, 2023 CVE Updated
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln PYSEC-2018-51
vulnetix vdb fixes PYSEC-2018-51Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/PYSEC-2018-51/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart