airflow-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Apache Spark (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (AIRFLOW-2592) Bump Bleach dependency to address CVE-2018-7753
Date Sun, 02 Sep 2018 18:01:02 GMT

    [ https://issues.apache.org/jira/browse/AIRFLOW-2592?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16601388#comment-16601388
] 

Apache Spark commented on AIRFLOW-2592:
---------------------------------------

User 'ctrebing' has created a pull request for this issue:
https://github.com/apache/incubator-airflow/pull/3524

> Bump Bleach dependency to address CVE-2018-7753
> -----------------------------------------------
>
>                 Key: AIRFLOW-2592
>                 URL: https://issues.apache.org/jira/browse/AIRFLOW-2592
>             Project: Apache Airflow
>          Issue Type: Task
>            Reporter: Jan
>            Assignee: Christian Trebing
>            Priority: Major
>             Fix For: 2.0.0
>
>
> CVE-2018-7753 was reported for bleach versions <= 2.1.2.
> [https://nvd.nist.gov/vuln/detail/CVE-2018-7753]
> CVE description: An issue was discovered in Bleach 2.1.x before 2.1.3. Attributes that
have URI values weren't properly sanitized if the values contained character entities. Using
character entities, it was possible to construct a URI value with a scheme that was not allowed
that would slide through unsanitized.



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)

Mime
View raw message