Rocky Linux 8 : idm:DL1 and idm:client (RLSA-2021:1846)

medium Nessus Plugin ID 184746

Synopsis

The remote Rocky Linux host is missing a security update.

Description

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2021:1846 advisory.

- In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
(CVE-2020-11023)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

See Also

https://errata.rockylinux.org/RLSA-2021:1846

https://bugzilla.redhat.com/show_bug.cgi?id=1340463

https://bugzilla.redhat.com/show_bug.cgi?id=1357495

https://bugzilla.redhat.com/show_bug.cgi?id=1484088

https://bugzilla.redhat.com/show_bug.cgi?id=1542737

https://bugzilla.redhat.com/show_bug.cgi?id=1544379

https://bugzilla.redhat.com/show_bug.cgi?id=1660877

https://bugzilla.redhat.com/show_bug.cgi?id=1779981

https://bugzilla.redhat.com/show_bug.cgi?id=1780328

https://bugzilla.redhat.com/show_bug.cgi?id=1780510

https://bugzilla.redhat.com/show_bug.cgi?id=1780782

https://bugzilla.redhat.com/show_bug.cgi?id=1784657

https://bugzilla.redhat.com/show_bug.cgi?id=1809215

https://bugzilla.redhat.com/show_bug.cgi?id=1810148

https://bugzilla.redhat.com/show_bug.cgi?id=1812871

https://bugzilla.redhat.com/show_bug.cgi?id=1824193

https://bugzilla.redhat.com/show_bug.cgi?id=1850004

https://bugzilla.redhat.com/show_bug.cgi?id=1851835

https://bugzilla.redhat.com/show_bug.cgi?id=1857272

https://bugzilla.redhat.com/show_bug.cgi?id=1860129

https://bugzilla.redhat.com/show_bug.cgi?id=1866558

https://bugzilla.redhat.com/show_bug.cgi?id=1872603

https://bugzilla.redhat.com/show_bug.cgi?id=1875001

https://bugzilla.redhat.com/show_bug.cgi?id=1882340

https://bugzilla.redhat.com/show_bug.cgi?id=1891056

https://bugzilla.redhat.com/show_bug.cgi?id=1891505

https://bugzilla.redhat.com/show_bug.cgi?id=1891735

https://bugzilla.redhat.com/show_bug.cgi?id=1891741

https://bugzilla.redhat.com/show_bug.cgi?id=1891832

https://bugzilla.redhat.com/show_bug.cgi?id=1891850

https://bugzilla.redhat.com/show_bug.cgi?id=1894800

https://bugzilla.redhat.com/show_bug.cgi?id=1901068

https://bugzilla.redhat.com/show_bug.cgi?id=1902173

https://bugzilla.redhat.com/show_bug.cgi?id=1902727

https://bugzilla.redhat.com/show_bug.cgi?id=1903025

https://bugzilla.redhat.com/show_bug.cgi?id=1904484

https://bugzilla.redhat.com/show_bug.cgi?id=1904612

https://bugzilla.redhat.com/show_bug.cgi?id=1905919

https://bugzilla.redhat.com/show_bug.cgi?id=1909876

https://bugzilla.redhat.com/show_bug.cgi?id=1912845

https://bugzilla.redhat.com/show_bug.cgi?id=1922955

https://bugzilla.redhat.com/show_bug.cgi?id=1923900

https://bugzilla.redhat.com/show_bug.cgi?id=1924026

https://bugzilla.redhat.com/show_bug.cgi?id=1924501

https://bugzilla.redhat.com/show_bug.cgi?id=1924812

https://bugzilla.redhat.com/show_bug.cgi?id=1925410

https://bugzilla.redhat.com/show_bug.cgi?id=1926699

https://bugzilla.redhat.com/show_bug.cgi?id=1926910

https://bugzilla.redhat.com/show_bug.cgi?id=1928900

https://bugzilla.redhat.com/show_bug.cgi?id=1930426

https://bugzilla.redhat.com/show_bug.cgi?id=1932289

https://bugzilla.redhat.com/show_bug.cgi?id=1939371

https://bugzilla.redhat.com/show_bug.cgi?id=871208

Plugin Details

Severity: Medium

ID: 184746

File Name: rocky_linux_RLSA-2021-1846.nasl

Version: 1.1

Type: local

Published: 11/6/2023

Updated: 11/7/2023

Supported Sensors: Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.6

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.6

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS Score Source: CVE-2020-11023

CVSS v3

Risk Factor: Medium

Base Score: 6.1

Temporal Score: 5.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:rocky:linux:python3-kdcproxy, p-cpe:/a:rocky:linux:ipa-client-epn, p-cpe:/a:rocky:linux:ipa-healthcheck, p-cpe:/a:rocky:linux:python3-yubico, p-cpe:/a:rocky:linux:softhsm-debuginfo, p-cpe:/a:rocky:linux:ipa-server-trust-ad-debuginfo, p-cpe:/a:rocky:linux:softhsm-debugsource, p-cpe:/a:rocky:linux:opendnssec, p-cpe:/a:rocky:linux:ipa-debugsource, p-cpe:/a:rocky:linux:python3-ipalib, p-cpe:/a:rocky:linux:ipa-client-debuginfo, p-cpe:/a:rocky:linux:ipa-healthcheck-core, p-cpe:/a:rocky:linux:softhsm-devel, cpe:/o:rocky:linux:8, p-cpe:/a:rocky:linux:ipa-client-samba, p-cpe:/a:rocky:linux:ipa-server-debuginfo, p-cpe:/a:rocky:linux:bind-dyndb-ldap-debugsource, p-cpe:/a:rocky:linux:python3-custodia, p-cpe:/a:rocky:linux:python3-ipatests, p-cpe:/a:rocky:linux:python3-qrcode-core, p-cpe:/a:rocky:linux:python3-qrcode, p-cpe:/a:rocky:linux:ipa-client, p-cpe:/a:rocky:linux:bind-dyndb-ldap, p-cpe:/a:rocky:linux:python3-ipaclient, p-cpe:/a:rocky:linux:ipa-server-trust-ad, p-cpe:/a:rocky:linux:ipa-server-dns, p-cpe:/a:rocky:linux:ipa-debuginfo, p-cpe:/a:rocky:linux:opendnssec-debuginfo, p-cpe:/a:rocky:linux:ipa-selinux, p-cpe:/a:rocky:linux:bind-dyndb-ldap-debuginfo, p-cpe:/a:rocky:linux:ipa-client-common, p-cpe:/a:rocky:linux:python3-ipaserver, p-cpe:/a:rocky:linux:custodia, p-cpe:/a:rocky:linux:ipa-common, p-cpe:/a:rocky:linux:python3-pyusb, p-cpe:/a:rocky:linux:softhsm, p-cpe:/a:rocky:linux:ipa-server, p-cpe:/a:rocky:linux:ipa-python-compat, p-cpe:/a:rocky:linux:ipa-server-common, p-cpe:/a:rocky:linux:python3-jwcrypto, p-cpe:/a:rocky:linux:opendnssec-debugsource

Required KB Items: Host/local_checks_enabled, Host/RockyLinux/release, Host/RockyLinux/rpm-list, Host/cpu

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 5/18/2021

Vulnerability Publication Date: 4/29/2020

Reference Information

CVE: CVE-2020-11023