PyPI/bleach CVE-2020-6817: unknown, EPSS 0.72%

In Mozilla Bleach before 3.1.4, `bleach.clean` behavior parsing style attributes could result in a regular expression denial of service (ReDoS).

Action: Upgrade bleach to 3.1.4 or later.

pip install bleach==3.1.4

Affected

Fixed versions

Sources

• osv: PYSEC-2020-340
• https://github.com/mozilla/bleach/security/advisories/GHSA-vqhp-cxgc-6wmm
• https://blog.r2c.dev/posts/finding-python-redos-bugs-at-scale-using-dlint-and-r2c/
• https://bugzilla.mozilla.org/show_bug.cgi?id=1623633
• https://github.com/mozilla/bleach/releases/tag/v3.1.4
• https://snyk.io/vuln/SNYK-PYTHON-BLEACH-561754

CVE-2020-6817 · published 2020-03-30T19:45:00Z · modified 2023-11-08T04:03:57.176645Z · JSON