Описание
In the Loofah gem for Ruby through v2.3.0 unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.
Отчет
Supported versions of Satellite 6 contain a vulnerable version of rubygem-loofah. However, it is not possible to inject untrusted SVG files, and thus it is considered that this vulnerability can not be triggered. A future update may fix this vulnerability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| CloudForms Management Engine 5 | cfme-amazon-smartstate | Will not fix | ||
| CloudForms Management Engine 5 | cfme-gemset | Will not fix | ||
| Red Hat Satellite 6 | tfm-ror51-rubygem-loofah | Not affected | ||
| Red Hat Satellite 6 | tfm-ror52-rubygem-loofah | Not affected | ||
| Red Hat Software Collections | rh-ror50-rubygem-loofah | Will not fix |
Показывать по
Дополнительная информация
Статус:
EPSS
4.6 Medium
CVSS3
Связанные уязвимости
In the Loofah gem for Ruby through v2.3.0 unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.
In the Loofah gem for Ruby through v2.3.0 unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.
In the Loofah gem for Ruby through v2.3.0 unsanitized JavaScript may o ...
EPSS
4.6 Medium
CVSS3