Login
Login-Name Passwort


 
Newsletter
Werbung

Sicherheit: Ausführen beliebiger Kommandos in ruby-loofah
Aktuelle Meldungen Distributionen
Name: Ausführen beliebiger Kommandos in ruby-loofah
ID: DSA-4171-1
Distribution: Debian
Plattformen: Debian stretch
Datum: Fr, 13. April 2018, 23:38
Referenzen: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8048
Applikationen: ruby-loofah

Originalnachricht

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-4171-1 security@debian.org
https://www.debian.org/security/ Salvatore Bonaccorso
April 13, 2018 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : ruby-loofah
CVE ID : CVE-2018-8048
Debian Bug : 893596

The Shopify Application Security Team reported that ruby-loofah, a
general library for manipulating and transforming HTML/XML documents and
fragments, allows non-whitelisted attributes to be present in sanitized
output when input with specially-crafted HTML fragments. This might
allow to mount a code injection attack into a browser consuming
sanitized output.

For the stable distribution (stretch), this problem has been fixed in
version 2.0.3-2+deb9u1.

We recommend that you upgrade your ruby-loofah packages.

For the detailed security status of ruby-loofah please refer to its
security tracker page at:
https://security-tracker.debian.org/tracker/ruby-loofah

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org
-----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAlrRAO5fFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND
z0SyAQ/6AuoBIQB14OW/4cibdZW6OtsRkM+5yO3zjWrQi0zdU0GpYh+SKlBhLzPp
KcaWn6Ux7MUaVF54Yf8EfgbZnNDFWyBAfXjOvOfqnQ35NIis3segNmJFeTfVXf3S
tHISfEGifesFPUD1Pp/60pEXR9OjHjVOIZvV0/GphiibAWYMjjRNll30wcOn1sJL
rSSuMXcku3L4luZ86Ur3Pye9Q5d9L3HeVHAGtOFYqtAlWNpmLHeyGPBVqsm899vL
cDaH7bv98LUTghEpXDErJag6l8D2zpmIGwbhicmZ9v6byWD4n8yDn2Ma1x0lxQnT
au2VESuraruiwrXizREcCZST0IOgxI3K+XwiZsL/7z5h5PnhxGMiI1pWI34iliej
7ebXchW+si5we23GYXtvYxCNLqGbyX8fSaPWPl2dXDRwAh6dKa3KE0n7L8nTOabA
epWeejp8izJyiBo+AHUuxIz5ApLyHg70+TPDTu82oqohBaSLOpetqagO0kz8eOl7
bqOI6Gcgr9JAD1IkrSniktooj74ZMgXyEF6pjqsrV4GAh2vDlmkAjInxn+FsKcF5
fStbB1pytTXCSQRoJl72RqJ9vsWbtA7iMGu2QLu3KaOCFIn9BT4KSGI55GYh8u/u
vFqV39VbxF2K5SCqlutP2cHrOybfZnnkGoH/8zKYteWFc4SvhjU=
=aTX5
-----END PGP SIGNATURE-----
Pro-Linux
Unterstützer werden
Neue Nachrichten
Werbung