CVE-2017-15612

Upstream information

CVE-2017-15612 at MITRE

Description

mistune.py in Mistune 0.7.4 allows XSS via an unexpected newline (such as in java\nscript:) or a crafted email address, related to the escape and autolink functions.

---

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having moderate severity.

CVSS v2 Scores

	National Vulnerability Database
Base Score	4.3
Vector	AV:N/AC:M/Au:N/C:N/I:P/A:N
Access Vector	Network
Access Complexity	Medium
Authentication	None
Confidentiality Impact	None
Integrity Impact	Partial
Availability Impact	None

CVSS v3 Scores

	National Vulnerability Database
Base Score	6.1
Vector	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Access Vector	Network
Access Complexity	Low
Privileges Required	None
User Interaction	Required
Scope	Changed
Confidentiality Impact	Low
Integrity Impact	Low
Availability Impact	None
CVSSv3 Version	3

SUSE Bugzilla entry: 1064640 [RESOLVED / FIXED]

SUSE Security Advisories:

• openSUSE-SU-2018:0402-1, published Fri, 9 Feb 2018 00:07:32 +0100 (CET)

List of released packages

Product(s)	Fixed package version(s)	References
openSUSE Tumbleweed	python36-mistune >= 0.8.4-3.5 python38-mistune >= 0.8.4-3.5 python39-mistune >= 0.8.4-3.5	Patchnames: openSUSE Tumbleweed GA python36-mistune-0.8.4-3.5