Описание
JSDom improperly allows the loading of local resources, which allows for local files to be manipulated by a malicious web page when script execution is enabled.
A flaw was found in jsdom. JSDom improperly allows the loading of local resources, which allows for local files to be manipulated by a malicious web page when script execution is enabled.
Отчет
For an application which includes jsdom to be vulnerable to this CVE, it must at least enable the loading of resources using something similar to: new JSDOM(html, {resources: "usable"}, where html is un-trusted input. Furthermore, scripts can be executed by extending the options similar to: new JSDOM(html, {resources: "usable", runScripts: "dangerously"}. [1]
OpenShift Container Platform (OCP) and OpenShift ServiceMesh (OSSM) both include components that package a vulnerable version of jsdom. However, none of the components directly enable the loading of resources via resources: "usable" and most components only include jsdom for use in tests. Hence for OCP and OSSM the affects are rated to have a Low impact and are wontfix at this time and might be fixed in a future release.
[1] https://github.com/jsdom/jsdom#loading-subresources
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| OpenShift Service Mesh 2.0 | kiali | Not affected | ||
| OpenShift Service Mesh 2.0 | servicemesh-grafana | Will not fix | ||
| OpenShift Service Mesh 2.0 | servicemesh-prometheus | Will not fix | ||
| Red Hat Advanced Cluster Management for Kubernetes 2 | search-api | Not affected | ||
| Red Hat OpenShift Container Platform 4 | openshift4/ose-grafana | Will not fix | ||
| Red Hat OpenShift Container Platform 4 | openshift4/ose-prometheus | Will not fix | ||
| Red Hat OpenShift Container Platform 4 | openshift4/ose-thanos-rhel8 | Will not fix |
Показывать по
Дополнительная информация
Статус:
EPSS
5.6 Medium
CVSS3
Связанные уязвимости
JSDom improperly allows the loading of local resources, which allows for local files to be manipulated by a malicious web page when script execution is enabled.
JSDom improperly allows the loading of local resources, which allows for local files to be manipulated by a malicious web page when script execution is enabled.
JSDom improperly allows the loading of local resources, which allows f ...
Withdrawn Advisory: Insufficient Granularity of Access Control in JSDom
EPSS
5.6 Medium
CVSS3