In Mozilla Bleach before 3.1.4, `bleach.clean` behavior parsing style attributes could result in a regular expression denial of service (ReDoS).
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2020-6817US | high7.5 | — | ||
bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attri… | ||||
02
references
External citations — patches, advisories, analysis.
- https://blog.r2c.dev/posts/finding-python-redos-bugs-at-scale-using-dlint-and-r2c/ARTICLE
- https://bugzilla.mozilla.org/show_bug.cgi?id=1623633REPORT
- https://github.com/mozilla/bleach/releases/tag/v3.1.4WEB
- https://github.com/mozilla/bleach/security/advisories/GHSA-vqhp-cxgc-6wmmADVISORY
- https://snyk.io/vuln/SNYK-PYTHON-BLEACH-561754ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan