Bug 1591854 (CVE-2017-16012)

Summary:	CVE-2017-16012 js-jquery: XSS in responses from cross-origin ajax requests
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	akarol, apevec, bkearney, bmaxwell, cdewolf, chazlett, chrisw, cpelland, csutherl, ctubbsii, dajohnso, darran.lofthouse, dimitris, dmetzger, dosoudil, drieden, gblomqui, gmccullo, gtanzill, hhorak, hmore, java-maint, jawilson, jfrey, jhardy, jjoyce, jorton, jprause, jschluet, jshepherd, kbasil, krathod, lgao, lhh, loleary, lpeer, markmc, maschmid, mburns, mrunge, murat.ungor, myarboro, nobody, obarenbo, ohadlevy, pdrozd, pgier, pslavice, psotirop, rbean, rdopiera, rhos-maint, rnetuka, roliveri, rsvoboda, ruby-maint, sclewis, simaishi, slinaber, smallamp, spinder, sthorger, strzibny, tdecacqu, theute, tlestach, twalsh, vondruch, vtunka
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
See Also:	https://issues.redhat.com/browse/ENTESB-9103 https://issues.redhat.com/browse/RHSSO-1746
Whiteboard:
Fixed In Version:	js-jquery 3.0.0	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-03-26 16:31:51 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1399546, 1399547, 1399549, 1399551, 1399552, 1399553, 1399554, 1399556, 1447005, 1447011, 1447012, 1591855, 1591856, 1591857, 1591858, 1591859, 1591860, 1591861, 1591862, 1591863, 1591864, 1591865, 1593158, 1593159, 1593160, 1593161, 1593162, 1593163, 1593540, 1700981, 1826674
Bug Blocks:	1591866

Description Pedro Sampaio 2018-06-15 17:32:27 UTC

Affected versions of jquery interpret text/javascript responses from cross-origin ajax requests, and automatically execute the contents in jQuery.globalEval, even when the ajax request doesn't contain the dataType option.

Upstream issue:

https://github.com/jquery/jquery/issues/2432

Upstream patch:

https://github.com/jquery/jquery/commit/b078a62013782c7424a4a61a240c23c4c0b42614

References:

https://nodesecurity.io/advisories/328

Comment 1 Pedro Sampaio 2018-06-15 17:33:35 UTC

Created js-jquery tracking bugs for this issue:

Affects: fedora-all [bug 1591855]


Created js-jquery1 tracking bugs for this issue:

Affects: fedora-all [bug 1591859]


Created js-jquery2 tracking bugs for this issue:

Affects: fedora-all [bug 1591857]


Created python-XStatic-jQuery tracking bugs for this issue:

Affects: epel-7 [bug 1591863]
Affects: fedora-all [bug 1591858]


Created python-tw2-jquery tracking bugs for this issue:

Affects: epel-all [bug 1591860]
Affects: fedora-all [bug 1591856]


Created rubygem-jquery-rails tracking bugs for this issue:

Affects: fedora-all [bug 1591862]

Comment 15 errata-xmlrpc 2020-03-26 15:47:11 UTC

This issue has been addressed in the following products:

  Red Hat Fuse 7.6.0

Via RHSA-2020:0983 https://access.redhat.com/errata/RHSA-2020:0983

Comment 16 Product Security DevOps Team 2020-03-26 16:31:51 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2017-16012

Comment 18 Yadnyawalk Tale 2020-04-20 13:17:11 UTC

Satellite 5.8 is currently in Maintenance Support 2 phase that means we're addressing only Critical and selected Important Impact Security Advisories.
Reference -- https://access.redhat.com/support/policy/updates/satellite