REDHAT-BUG-684877: Medium severity python feed parser vulnerability
The Python Feed Parser program (python-feedparser) recently released version 5.0.1 with the following fixes:
Fix issue 91 (invalid text in XML declaration causes sanitizer to crash) Fix issue 254 (sanitization can be bypassed by malformed XML comments) Fix issue 255 (sanitizer doesn't strip unsafe URI schemes)
Giving the code a quick look, I don't believe the latter two issues affected 4.1 (possibly introduced in the 5.0 release). The first issue was reported against version 4.1 so would affect what we currently ship in Fedora and EPEL.
Version 5.0.1 corrects these flaws. It may be worthwhile to update to the latest version as the 5.0 release corrected a number of bugs and adds CSS/HTML5 sanitization.
Affected Software
Event History
Frequently Asked Questions
What specific issues does REDHAT-BUG-684877 address in Python Feed Parser?
REDHAT-BUG-684877 addresses an invalid XML declaration crash, bypassable sanitization from malformed XML comments, and additional sanitizer issues.
What version includes the fixes for REDHAT-BUG-684877?
The fixes for REDHAT-BUG-684877 are included in Python Feed Parser version 5.0.1.
How can I mitigate the vulnerabilities described in REDHAT-BUG-684877?
To mitigate the vulnerabilities in REDHAT-BUG-684877, update Python Feed Parser to version 5.0.1 or later.
Is REDHAT-BUG-684877 a critical vulnerability?
REDHAT-BUG-684877 includes significant issues that can impact application security and should be addressed promptly.
Where can I find more information about REDHAT-BUG-684877?
More information about REDHAT-BUG-684877 can be found in the Red Hat Bugzilla reports.