CVE:CVE-2020-27783
CNNVD:CNNVD-202011-1920
Lxml是Lxml个人开发者的一个可与Python交互用于定位Html中元素的软件。
Lxml 存在跨站脚本漏洞，该漏洞源于javascript通过noscript和style组合进行转义。以下产品及版本会受到影响：Debian stretch, Debian stretch (security), Debian buster, Debian bullseye, sid; Red Hat Software Collections, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 5, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8 , Red Hat OpenStack Platform 10 (Newton), Red Hat OpenStack Platform 13 (Queens)
solution:Upgrade lxml lxml to a higher version than 4.6.2,and avoid the version [1.2,4.6.2); Upgrade redhat software_collections to a higher version than -; Upgrade redhat enterprise_linux to a higher version than 8.0,and avoid the version 8.0; Upgrade debian debian_linux to a higher version than 9.0,10.0,and avoid the version 9.0,10.0; Upgrade fedoraproject fedora to a higher version than 32,33,and avoid the version 32,33; Upgrade netapp snapcenter to a higher version than -; Upgrade oracle communications_offline_mediation_controller to a higher version than 12.0.0.3.0,and avoid the version 12.0.0.3.0; Upgrade oracle zfs_storage_appliance_kit to a higher version than 8.8,and avoid the version 8.8