mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-09-10 08:14:09 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/python-markdown2: fix CVE-2020-11888

Browse Source 
python-markdown2 through 2.3.8 allows XSS because element names are
mishandled unless a \w+ match succeeds. For example, an attack might use
elementname@ or elementname- with an onclick attribute.

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
This commit is contained in:
Fabrice Fontaine
2020-05-11 21:22:37 +02:00
committed by Thomas Petazzoni
parent 2c3dc380a0
commit 604fe08806
3 changed files with 89 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
package/python-markdown2/python-markdown2.mk
View File

@@ -11,4 +11,8 @@ PYTHON_MARKDOWN2_SETUP_TYPE = setuptools
PYTHON_MARKDOWN2_LICENSE = MIT
PYTHON_MARKDOWN2_LICENSE_FILES = LICENSE.txt
# 0001-Fix-for-issue-348-incomplete-tags-with-punctuation-after-as-part-of.patch
# 0002-Better-fix-for-issue-348.patch
PYTHON_MARKDOWN2_IGNORE_CVES += CVE-2020-11888
$(eval $(python-package))