Fix CVE-2021-28957

missing input sanitization for formaction HTML5 attributes may lead to XSS

Resolves: rhbz#1941535

python-lxml.spec

@@ -2,7 +2,7 @@
 
 Name:           python-%{modname}
 Version:        4.5.1
-Release:        3%{?dist}
+Release:        4%{?dist}
 Summary:        XML processing library combining libxml2/libxslt with the ElementTree API
 
 License:        BSD
@@ -11,6 +11,11 @@ Source0:        https://lxml.de/files/%{modname}-%{version}.tgz
 Patch0001:      https://github.com/lxml/lxml/commit/fa1d856cad369d0ac64323ddec14b02281491706.patch#/0001-Avoid-globally-overriding-the-libxml2-external-entit.patch
 Patch0002:      0002-Fix-CVE-2020-27783-mXSS-due-to-the-use-of-improper-p.patch
 
+# Fix for CVE-2021-28957:
+# missing input sanitization for formaction HTML5 attributes may lead to XSS
+# Resolved upstream: https://github.com/lxml/lxml/commit/2d01a1ba8984e0483ce6619b972832377f208a0d
+Patch0003:      0003-Fix-CVE-2021-28957.patch
+
 BuildRequires:  gcc
 BuildRequires:  libxml2-devel
 BuildRequires:  libxslt-devel
@@ -59,6 +64,10 @@ env WITH_CYTHON=true %py3_build
 %{python3_sitearch}/%{modname}-*.egg-info/
 
 %changelog
+* Fri May 21 2021 Charalampos Stratakis <cstratak@redhat.com> - 4.5.1-4
+- Fix CVE-2021-28957: missing input sanitization for formaction HTML5 attributes may lead to XSS
+- Resolves: rhbz#1941535
+
 * Fri Dec 18 2020 Mikolaj Izdebski <mizdebsk@redhat.com> - 4.5.1-3
 - Fix mXSS vulnerability due to the use of improper parser
 - Resolves: CVE-2020-27783