In the Loofah gem for Ruby, through v2.2.2, unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.

This update for rubygem-loofah fixes the following issues :

Security issue fixed :

  - CVE-2018-16468: Fixed XXS by removing the svg animate     attribute `from` from the allowlist (bsc#1113969).

This update was imported from the SUSE:SLE-15:Update update project.

This update for rmt-server to version 1.1.1 fixes the following issues :

The following issues have been fixed :

  - Fixed migration problems which caused some extensions /     modules to be dropped (bsc#1118584, bsc#1118579)

  - Fixed listing of mirrored products (bsc#1102193)

  - Include online migration paths into offline migration     (bsc#1117106)

  - Sync products that do not have a base product     (bsc#1109307)

  - Fixed SLP auto discovery for RMT (bsc#1113760)

Update dependencies for security fixes :

  - CVE-2018-16468: Update loofah to 2.2.3 (bsc#1113969)

  - CVE-2018-16470: Update rack to 2.0.6 (bsc#1114831)

  - CVE-2018-14404: Update nokogiri to 1.8.5 (bsc#1102046)

This update was imported from the SUSE:SLE-15:Update update project.

This update for rmt-server to version 1.1.1 fixes the following issues :

The following issues have been fixed :

Fixed migration problems which caused some extensions / modules to be dropped (bsc#1118584, bsc#1118579)

Fixed listing of mirrored products (bsc#1102193)

Include online migration paths into offline migration (bsc#1117106)

Sync products that do not have a base product (bsc#1109307)

Fixed SLP auto discovery for RMT (bsc#1113760)

Update dependencies for security fixes: CVE-2018-16468: Update loofah to 2.2.3 (bsc#1113969)

CVE-2018-16470: Update rack to 2.0.6 (bsc#1114831)

CVE-2018-14404: Update nokogiri to 1.8.5 (bsc#1102046)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that ruby-loofah, a general library for manipulating and transforming HTML/XML documents and fragments, performed insufficient sanitising of SVG elements.

XXS when a crafted SVG element is republished (CVE-2018-16468).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to Loofah 2.2.3.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for rubygem-loofah fixes the following issues :

Security issue fixed :

CVE-2018-16468: Fixed XXS by removing the svg animate attribute `from` from the allowlist (bsc#1113969).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

GitHub issue :

This issue has been created for public disclosure of an XSS vulnerability that was responsibly reported (independently) by Shubham Pathak and @yasinS (Yasin Soliman).

In the Loofah gem, through v2.2.2, unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.

ID	Name	Product	Family	Severity
123391	openSUSE Security Update : rubygem-loofah (openSUSE-2019-963)	Nessus	SuSE Local Security Checks	medium
122227	openSUSE Security Update : rmt-server (openSUSE-2019-185)	Nessus	SuSE Local Security Checks	medium
121637	SUSE SLES15 Security Update : rmt-server (SUSE-SU-2019:0272-1)	Nessus	SuSE Local Security Checks	medium
121057	Debian DSA-4364-1 : ruby-loofah - security update	Nessus	Debian Local Security Checks	medium
120832	Fedora 28 : rubygem-loofah (2018-d716df9942)	Nessus	Fedora Local Security Checks	medium
120828	Fedora 29 : rubygem-loofah (2018-d5fcbb9ca6)	Nessus	Fedora Local Security Checks	medium
120172	SUSE SLED15 / SLES15 Security Update : rubygem-loofah (SUSE-SU-2018:3928-1)	Nessus	SuSE Local Security Checks	medium
119296	openSUSE Security Update : rubygem-loofah (openSUSE-2018-1478)	Nessus	SuSE Local Security Checks	medium
119243	Fedora 27 : rubygem-loofah (2018-4ce40afcb6)	Nessus	Fedora Local Security Checks	medium
118704	FreeBSD : Loofah -- XSS vulnerability (36a2a89e-7ee1-4ea4-ae22-7ca38019c8d0)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2018-16468

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium