Critical URI Sanitization Flaw in Bleach Package (CVE-2018-7753)
Summary
CVE-2018-7753: An issue was discovered in Bleach 2.1.x before 2.1.3. Affects python-bleach across 3 version ranges.
< 2.1.3-1
< 9584f42051c0039cb0f27a617e8ab3e945018cc6
< c5df5789ec3471a31311f42c2d19fc2cf21b35ef
Fixed in 2.1.3-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Bleach is a popular HTML sanitizing library for Python, designed to allow safe rendering of HTML content by removing potentially harmful elements. It is widely used in web applications to prevent XSS (Cross-Site Scripting) attacks. The vulnerability in question affects versions 2.1.x prior to 2.1.3, where attributes containing URI values were not properly sanitized, leading to potential security risks.
Vulnerability Detail
CVE-2018-7753 is a critical vulnerability that arises from improper sanitization of URI values in the Bleach library. Specifically, when character entities are used in URI attributes, they can bypass the sanitization process, allowing attackers to construct malicious URIs with unauthorized schemes. This flaw can lead to severe consequences, including unauthorized access and exploitation of web applications that rely on Bleach for HTML sanitization.
How To Fix
Minimum fixed version
2.1.3-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-bleachTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, consider implementing additional validation on URI attributes within your application to ensure that only safe and expected schemes are allowed. This can be done by manually checking the URI values before processing them.
Conclusion
CVE-2018-7753 represents a significant security vulnerability in the Bleach library, affecting its ability to properly sanitize URI values. Users are strongly advised to upgrade to the latest version to mitigate risks. Additionally, implementing workarounds can provide temporary relief until an upgrade is feasible.
See every vulnerability recorded for python-bleach →
FAQ
CVE-2018-7753 is a vulnerability in the Bleach library that allows improper sanitization of URI values, potentially leading to security risks.
Bleach versions 2.1.x before 2.1.3 are affected by this vulnerability.
Exploitation of this vulnerability can lead to unauthorized access and manipulation of web applications, posing significant security threats.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score for CVE-2018-7753 is 9.8, indicating a critical level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for python-bleach.
