CVE-2020-27783

Advisory

Scancode-toolkit 21.2.9 updates its dependency 'lxml' to v4.6.2 to include a security fix.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

-------

Security:
~~~~~~~~~

- Update vulnerable LXML to version 4.6.2 to fix
https://nvd.nist.gov/vuln/detail/CVE-2020-27783
This was detected thanks to https://github.com/nexb/vulnerablecode

Operating system support:
~~~~~~~~~~~~~~~~~~~~~~~~~

- Drop support for Python 2 295
- Drop support for 32 bits on Windows 335
- Add support for Python 64 bits on Windows 64 bits 335
- Add support for Python 3.6, 37, 3.8 and 3.9 on Linux, Windows and macOS.
These are now tested on Azure.
- Add deprecation message for native Windows support 2366

License scanning:
~~~~~~~~~~~~~~~~~

- Improve license detection accuracy with over 8400 new license detection rules
added or updated
- Remove the previously deprecated --license-diag option
- Include pre-built license index in release archives to speed up start 988
- Use SPDX LicenseRef-scancode namespace for all licenses keys not in SPDX
- Replace DEJACODE_LICENSE_URL with SCANCODE_LICENSEDB_URL at
https://scancode-licensedb.aboutcode.org #2165
- Add new license flag in license detection results "is_license_intro" that
is used to indicate that a license rule is a short license introduction
statement (that typically may be reported as some unknown license)

Package scanning:
~~~~~~~~~~~~~~~~~

- Add detection of package-installed files
- Add analysis of system package installed databases for Debian, OpenWRT and
Alpine Linux packages
- Add support for Alpine Linux, Debian, OpenWRT.

Copyright scanning:
~~~~~~~~~~~~~~~~~~~

- Improve detection with minor grammar fixes

Misc.:
~~~~~~

- Adopt a new calendar date-based versioning for scancode-toolkit version numbers
- Update thirdparty dependencies and built-in plugins
- Allow installation without extractcode and typecode native plugins. Instead
one can elect to install these or not to have a lighter footprint if needed.
- Update configuration and bootstrap scripts to support a new PyPI-like
repository at https://thirdparty.aboutcode.org/pypi/
- Create new release scripts to populate released archives with just the
required wheels of a given OS and Python version.
- Updated scancode.bat to handle % signs in the arguments 1876

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27783