CVE-2018-7753: Input Validation
An issue was discovered in Bleach 2.1.x before 2.1.3. Attributes that have URI values weren't properly sanitized if the values contained character entities. Using character entities, it was possible to construct a URI value with a scheme that was not allowed that would slide through unsanitized.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/bleachto a version that resolves this vulnerability.Fixed in 2.1.3
Event History
Frequently Asked Questions
What is the severity of CVE-2018-7753?
CVE-2018-7753 is rated as a medium severity vulnerability.
How do I fix CVE-2018-7753?
To fix CVE-2018-7753, upgrade Bleach to version 2.1.3 or later.
What versions of Bleach are affected by CVE-2018-7753?
Bleach versions 2.1.0, 2.1.1, and 2.1.2 are affected by CVE-2018-7753.
What is the nature of the vulnerability in CVE-2018-7753?
CVE-2018-7753 involves improper sanitization of URI attribute values, allowing unauthorized schemes to pass through.
Is there a patch for CVE-2018-7753?
Yes, a patch was introduced in Bleach version 2.1.3 to address CVE-2018-7753.