CVE-2020-26298

Опубликовано: 11 янв. 2021

Источник: nvd

CVSS3: 6.8

CVSS3: 5.4

CVSS2: 3.5

EPSS Низкий

Описание

Redcarpet is a Ruby library for Markdown processing. In Redcarpet before version 3.5.1, there is an injection vulnerability which can enable a cross-site scripting attack. In affected versions no HTML escaping was being performed when processing quotes. This applies even when the :escape_html option was being used. This is fixed in version 3.5.1 by the referenced commit.

Ссылки

https://github.com/advisories/GHSA-q3wr-qw3g-3p4h
Third Party Advisory
https://github.com/vmg/redcarpet/blob/master/CHANGELOG.md#version-351-security
Release Notes
Third Party Advisory
https://github.com/vmg/redcarpet/commit/a699c82292b17c8e6a62e1914d5eccc252272793
Patch
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/01/msg00014.html
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFMYDIONVWATY7EB6EARDVXT47AYCRNM/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNO4ZZUPGAEUXKQL4G2HRIH7CUZKPCT6/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PXNNWHHAPREDM3XJDACYRTK7DBMUONBI/
https://rubygems.org/gems/redcarpet
Product
Third Party Advisory
https://www.debian.org/security/2021/dsa-4831
Third Party Advisory
https://github.com/advisories/GHSA-q3wr-qw3g-3p4h
Third Party Advisory
https://github.com/vmg/redcarpet/blob/master/CHANGELOG.md#version-351-security
Release Notes
Third Party Advisory
https://github.com/vmg/redcarpet/commit/a699c82292b17c8e6a62e1914d5eccc252272793
Patch
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/01/msg00014.html
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFMYDIONVWATY7EB6EARDVXT47AYCRNM/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNO4ZZUPGAEUXKQL4G2HRIH7CUZKPCT6/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PXNNWHHAPREDM3XJDACYRTK7DBMUONBI/
https://rubygems.org/gems/redcarpet
Product
Third Party Advisory
https://www.debian.org/security/2021/dsa-4831
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:redcarpet_project:redcarpet:*:*:*:*:*:ruby:*:*

Версия до 3.5.1 (исключая)

Конфигурация 2

Одно из

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

EPSS

Процентиль: 56%

0.00334

Низкий

6.8 Medium

CVSS3

5.4 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-74

Связанные уязвимости

CVE-2020-26298

CVSS3: 6.8

ubuntu

около 5 лет назад

Redcarpet is a Ruby library for Markdown processing. In Redcarpet before version 3.5.1, there is an injection vulnerability which can enable a cross-site scripting attack. In affected versions no HTML escaping was being performed when processing quotes. This applies even when the `:escape_html` option was being used. This is fixed in version 3.5.1 by the referenced commit.

CVE-2020-26298

CVSS3: 6.8

redhat

около 5 лет назад

Redcarpet is a Ruby library for Markdown processing. In Redcarpet before version 3.5.1, there is an injection vulnerability which can enable a cross-site scripting attack. In affected versions no HTML escaping was being performed when processing quotes. This applies even when the `:escape_html` option was being used. This is fixed in version 3.5.1 by the referenced commit.

CVE-2020-26298

CVSS3: 6.8

debian

около 5 лет назад

Redcarpet is a Ruby library for Markdown processing. In Redcarpet befo ...

GHSA-q3wr-qw3g-3p4h

CVSS3: 6.8

github

около 5 лет назад

Injection/XSS in Redcarpet

BDU:2021-03625

CVSS3: 5.4

fstec

около 5 лет назад

Уязвимость библиотеки Ruby для парсинга Markdown в HTML Redcarpet, связанная с непринятием мер по защите структуры веб-страницы, позволяющая нарушителю оказать воздействие на целостность защищаемой информации

EPSS

Процентиль: 56%

0.00334

Низкий

6.8 Medium

CVSS3

5.4 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-74