Vulnerability CVE-2018-16468: Information
Description
In the Loofah gem for Ruby, through v2.2.2, unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.
Severity: MEDIUM (5.4) Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Fixed packages
Package name | Branch | Fixed in version | Version from repository | Errata ID | Task # | State |
---|---|---|---|---|---|---|
ruby-loofah | p9 | 2.2.3-alt1 | 2.2.3-alt1 | ALT-PU-2019-1536-1 | 225783 | Fixed |
ruby-loofah | c10f1 | 2.2.3-alt1 | 2.2.3-alt1 | ALT-PU-2019-1536-1 | 225783 | Fixed |
ruby-loofah | c9f2 | 2.2.3-alt1 | 2.2.3-alt1 | ALT-PU-2019-1536-1 | 225783 | Fixed |
References to Advisories, Solutions, and Tools
Hyperlink | Resource |
---|---|
https://github.com/flavorjones/loofah/issues/154 |
|
DSA-4364 |
|