From:
[email protected]
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- ------------------------------------------------------------------------- Debian Security Advisory DSA-4171-1
[email protected] https://www.debian.org/security/ Salvatore Bonaccorso
April 13, 2018
https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : ruby-loofah
CVE ID : CVE-2018-8048
Debian Bug : 893596
The Shopify Application Security Team reported that ruby-loofah, a
general library for manipulating and transforming HTML/XML documents and fragments, allows non-whitelisted attributes to be present in sanitized
output when input with specially-crafted HTML fragments. This might
allow to mount a code injection attack into a browser consuming
sanitized output.
For the stable distribution (stretch), this problem has been fixed in
version 2.0.3-2+deb9u1.
We recommend that you upgrade your ruby-loofah packages.
For the detailed security status of ruby-loofah please refer to its
security tracker page at:
https://security-tracker.debian.org/tracker/ruby-loofah
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at:
https://www.debian.org/security/
Mailing list:
[email protected]
-----BEGIN PGP SIGNATURE-----
iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAlrRAO5fFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2 NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND z0SyAQ/6AuoBIQB14OW/4cibdZW6OtsRkM+5yO3zjWrQi0zdU0GpYh+SKlBhLzPp KcaWn6Ux7MUaVF54Yf8EfgbZnNDFWyBAfXjOvOfqnQ35NIis3segNmJFeTfVXf3S tHISfEGifesFPUD1Pp/60pEXR9OjHjVOIZvV0/GphiibAWYMjjRNll30wcOn1sJL rSSuMXcku3L4luZ86Ur3Pye9Q5d9L3HeVHAGtOFYqtAlWNpmLHeyGPBVqsm899vL cDaH7bv98LUTghEpXDErJag6l8D2zpmIGwbhicmZ9v6byWD4n8yDn2Ma1x0lxQnT au2VESuraruiwrXizREcCZST0IOgxI3K+XwiZsL/7z5h5PnhxGMiI1pWI34iliej 7ebXchW+si5we23GYXtvYxCNLqGbyX8fSaPWPl2dXDRwAh6dKa3KE0n7L8nTOabA epWeejp8izJyiBo+AHUuxIz5ApLyHg70+TPDTu82oqohBaSLOpetqagO0kz8eOl7 bqOI6Gcgr9JAD1IkrSniktooj74ZMgXyEF6pjqsrV4GAh2vDlmkAjInxn+FsKcF5 fStbB1pytTXCSQRoJl72RqJ9vsWbtA7iMGu2QLu3KaOCFIn9BT4KSGI55GYh8u/u vFqV39VbxF2K5SCqlutP2cHrOybfZnnkGoH/8zKYteWFc4SvhjU=
=aTX5
-----END PGP SIGNATURE-----
--- SoupGate-Win32 v1.05
* Origin: you cannot sedate... all the things you hate (1:229/2)