drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Mangelnde Eingabeprüfung in ruby-sanitize
Name: |
Mangelnde Eingabeprüfung in ruby-sanitize |
|
ID: |
DSA-4358-1 |
|
Distribution: |
Debian |
|
Plattformen: |
Debian stretch |
|
Datum: |
Do, 27. Dezember 2018, 20:56 |
|
Referenzen: |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3740 |
|
Applikationen: |
ruby-sanitize |
|
Originalnachricht |
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512
- ------------------------------------------------------------------------- Debian Security Advisory DSA-4358-1 security@debian.org https://www.debian.org/security/ Salvatore Bonaccorso December 27, 2018 https://www.debian.org/security/faq - -------------------------------------------------------------------------
Package : ruby-sanitize CVE ID : CVE-2018-3740 Debian Bug : 893610
The Shopify Application Security Team discovered that ruby-sanitize, a whitelist-based HTML sanitizer, is prone to a HTML injection vulnerability. A specially crafted HTML fragment can cause to allow non- whitelisted attributes to be used on a whitelisted HTML element.
For the stable distribution (stretch), this problem has been fixed in version 2.1.0-2+deb9u1.
We recommend that you upgrade your ruby-sanitize packages.
For the detailed security status of ruby-sanitize please refer to its security tracker page at: https://security-tracker.debian.org/tracker/ruby-sanitize
Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE-----
iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAlwkw3FfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2 NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND z0QjiQ/+Kl2eo3dK11Y89BWyA6ABCC0P+1kldIuz/G+o0aJ4LkdojUh0UjOP4zpo liqM84GeNs0YJn+ou6xtm4Tbesv5fm7PeMIlHE98AnuwwRXL/yFIC2X0FcJybQ/I xvPKdcxfKaJCljSreyPT4uMaHf27J5P4QEHH7cIrzoCFvtgIcONfE2MV9wmGwqak JGpKVsW9/U9zIDPrVFGKyWamqqJ2pAIyoAHV/bF2J7b5TGte6hGycpLP4ilwn20h M545+AByYky18UlKdnXJIOazowO463VGpa6/0oAoUH8hGdzkRKREEHGDuhA7CBgW 8Qagb3NM/Gq5tgcrsSoqiVgy4iM+4MEgF8Qy1HwpNXIGYd791xr1ecfelcDfckPb ExTcFPlhfANGsqoMTUyuR9bbgRf6kFipdl/9ApzRNN8dEFatbbfL0ccBr6B/RTBz RD4nhDLV9rEma1/z13Ua08gZqnVoKLQGr32vFjlrq7U33gDBZBr/LAD18j4rHoVw zodDnX4qD9OpUBKkH1tjm0dW4gyhc+jzwe2K+Zl2cdknYrUgBsRObcmSiuvCJsRW ntG6DUlksnpefXrvu4NGXzDs2VXuvvVc2jSPPrbu+fecSstOE/u3H0/06Sz5nRvo n6D5oB9v5I2BMtbZxBIVHF1KCfp52mE/TpqFxh19GJbkg1Jsdw4= =wojJ -----END PGP SIGNATURE-----
|
|
|
|