Описание
Apostrophe Technologies sanitize-html before 2.3.1 does not properly handle internationalized domain name (IDN) which could allow an attacker to bypass hostname whitelist validation set by the "allowedIframeHostnames" option.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| OpenShift Service Mesh 2.0 | servicemesh-prometheus | Affected | ||
| Red Hat OpenShift Container Platform 4.7 | openshift4/ose-console | Fixed | RHSA-2020:5633 | 24.02.2021 |
| Red Hat OpenShift Container Platform 4.8 | openshift4/ose-thanos-rhel8 | Fixed | RHSA-2021:2438 | 27.07.2021 |
| Red Hat OpenShift Container Platform 4.9 | openshift4/ose-prometheus | Fixed | RHSA-2021:3759 | 18.10.2021 |
Показывать по
10
Дополнительная информация
Статус:
Moderate
Дефект:
CWE-20
https://bugzilla.redhat.com/show_bug.cgi?id=1932362sanitize-html: improper handling of internationalized domain name (IDN) can lead to bypass hostname whitelist validation
EPSS
Процентиль: 79%
0.01953
Низкий
5.3 Medium
CVSS3
Связанные уязвимости
CVSS3: 5.3
nvd
больше 5 лет назад
Apostrophe Technologies sanitize-html before 2.3.1 does not properly handle internationalized domain name (IDN) which could allow an attacker to bypass hostname whitelist validation set by the "allowedIframeHostnames" option.
CVSS3: 5.3
debian
больше 5 лет назад
Apostrophe Technologies sanitize-html before 2.3.1 does not properly h ...
EPSS
Процентиль: 79%
0.01953
Низкий
5.3 Medium
CVSS3