drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Ausführen beliebiger Kommandos in ruby-loofah
Name: |
Ausführen beliebiger Kommandos in ruby-loofah |
|
ID: |
DSA-4171-1 |
|
Distribution: |
Debian |
|
Plattformen: |
Debian stretch |
|
Datum: |
Fr, 13. April 2018, 23:38 |
|
Referenzen: |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8048 |
|
Applikationen: |
ruby-loofah |
|
Originalnachricht |
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512
- ------------------------------------------------------------------------- Debian Security Advisory DSA-4171-1 security@debian.org https://www.debian.org/security/ Salvatore Bonaccorso April 13, 2018 https://www.debian.org/security/faq - -------------------------------------------------------------------------
Package : ruby-loofah CVE ID : CVE-2018-8048 Debian Bug : 893596
The Shopify Application Security Team reported that ruby-loofah, a general library for manipulating and transforming HTML/XML documents and fragments, allows non-whitelisted attributes to be present in sanitized output when input with specially-crafted HTML fragments. This might allow to mount a code injection attack into a browser consuming sanitized output.
For the stable distribution (stretch), this problem has been fixed in version 2.0.3-2+deb9u1.
We recommend that you upgrade your ruby-loofah packages.
For the detailed security status of ruby-loofah please refer to its security tracker page at: https://security-tracker.debian.org/tracker/ruby-loofah
Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE-----
iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAlrRAO5fFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2 NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND z0SyAQ/6AuoBIQB14OW/4cibdZW6OtsRkM+5yO3zjWrQi0zdU0GpYh+SKlBhLzPp KcaWn6Ux7MUaVF54Yf8EfgbZnNDFWyBAfXjOvOfqnQ35NIis3segNmJFeTfVXf3S tHISfEGifesFPUD1Pp/60pEXR9OjHjVOIZvV0/GphiibAWYMjjRNll30wcOn1sJL rSSuMXcku3L4luZ86Ur3Pye9Q5d9L3HeVHAGtOFYqtAlWNpmLHeyGPBVqsm899vL cDaH7bv98LUTghEpXDErJag6l8D2zpmIGwbhicmZ9v6byWD4n8yDn2Ma1x0lxQnT au2VESuraruiwrXizREcCZST0IOgxI3K+XwiZsL/7z5h5PnhxGMiI1pWI34iliej 7ebXchW+si5we23GYXtvYxCNLqGbyX8fSaPWPl2dXDRwAh6dKa3KE0n7L8nTOabA epWeejp8izJyiBo+AHUuxIz5ApLyHg70+TPDTu82oqohBaSLOpetqagO0kz8eOl7 bqOI6Gcgr9JAD1IkrSniktooj74ZMgXyEF6pjqsrV4GAh2vDlmkAjInxn+FsKcF5 fStbB1pytTXCSQRoJl72RqJ9vsWbtA7iMGu2QLu3KaOCFIn9BT4KSGI55GYh8u/u vFqV39VbxF2K5SCqlutP2cHrOybfZnnkGoH/8zKYteWFc4SvhjU= =aTX5 -----END PGP SIGNATURE-----
|
|
|
|