id: PYSEC-2011-21
details: 'Cross-site scripting (XSS) vulnerability in feedparser.py in Universal Feed
  Parser (aka feedparser or python-feedparser) 5.x before 5.0.1 allows remote attackers
  to inject arbitrary web script or HTML via an unexpected URI scheme, as demonstrated
  by a javascript: URI.'
affected:
- package:
    name: feedparser
    ecosystem: PyPI
    purl: pkg:pypi/feedparser
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: '0'
    - fixed: 5.0.1
  versions:
  - '4.1'
  - '5.0'
references:
- type: WEB
  url: https://code.google.com/p/feedparser/issues/detail?id=255
- type: ADVISORY
  url: http://secunia.com/advisories/44074
- type: WEB
  url: http://lists.opensuse.org/opensuse-updates/2011-04/msg00026.html
- type: ADVISORY
  url: http://secunia.com/advisories/43730
- type: REPORT
  url: https://bugzilla.novell.com/show_bug.cgi?id=680074
- type: WEB
  url: http://openwall.com/lists/oss-security/2011/03/14/18
- type: REPORT
  url: https://bugzilla.redhat.com/show_bug.cgi?id=684877
- type: WEB
  url: http://support.novell.com/security/cve/CVE-2011-1158.html
- type: WEB
  url: http://openwall.com/lists/oss-security/2011/03/15/11
- type: WEB
  url: http://www.securityfocus.com/bid/46867
- type: ADVISORY
  url: http://www.mandriva.com/security/advisories?name=MDVSA-2011:082
- type: ADVISORY
  url: https://github.com/advisories/GHSA-4m72-rmm9-2qjr
aliases:
- CVE-2011-1158
- GHSA-4m72-rmm9-2qjr
modified: '2021-08-27T03:22:03.831291Z'
published: '2011-04-11T18:55:00Z'