Bug 1591854 (CVE-2017-16012)

Summary: CVE-2017-16012 js-jquery: XSS in responses from cross-origin ajax requests
Product: [Other] Security Response Reporter: Pedro Sampaio <psampaio>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: akarol, apevec, aschwart, asoldano, aszczucz, bbaranow, bkearney, bmaxwell, boliveir, brian.stansberry, bstansbe, cdewolf, chazlett, chrisw, cpelland, csutherl, ctubbsii, dajohnso, darran.lofthouse, dimitris, dkreling, dlofthou, dmetzger, dosoudil, drichtar, drieden, eglynn, fjuma, gblomqui, gmalinko, gmccullo, gtanzill, hhorak, hmore, istudens, ivassile, iweiss, janstey, java-maint, jawilson, jfrey, jhardy, jjoyce, jkoops, jorton, jpallich, jprause, jpretori, jschluet, jshepherd, kbasil, krathod, lgao, lhh, loleary, lpeer, lsvaty, markmc, maschmid, mburns, mgarciac, mosmerov, mposolda, mrunge, msochure, msvehla, murat.ungor, myarboro, nobody, nwallace, obarenbo, ohadlevy, pberan, pdelbell, pdrozd, peholase, pesilva, pgier, pgrist, pjindal, pmackay, pskopek, pslavice, psotirop, rbean, rdopiera, rhel-process-autobot, rhos-maint, rhos-maint, rmartinc, rnetuka, roliveri, rowaters, rstancel, rstepani, rsvoboda, ruby-maint, sclewis, simaishi, slinaber, smaestri, smallamp, spinder, ssilvert, sthorger, strzibny, tdecacqu, theute, thjenkin, tlestach, tom.jenkinson, twalsh, vdosoudi, vmuzikar, vondruch, vtunka, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
See Also: https://issues.redhat.com/browse/ENTESB-9103
https://issues.redhat.com/browse/RHSSO-1746
Whiteboard:
Fixed In Version: js-jquery 3.0.0 Doc Type: If docs needed, set a value
Doc Text:
[REJECTED CVE] This CVE has been rejected. This candidate is a duplicate of CVE-2015-9251. Note: All CVE users should reference CVE-2015-9251 instead of this candidate.
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-03-26 16:31:51 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1399546, 1399547, 1399549, 1399551, 1399552, 1399553, 1399554, 1399556, 1447005, 1447011, 1447012, 1591855, 1591856, 1591857, 1591858, 1591859, 1591860, 1591861, 1591862, 1591863, 1591864, 1591865, 1593158, 1593159, 1593160, 1593161, 1593162, 1593163, 1593540, 1700981, 1826674    
Bug Blocks: 1591866    

Description Pedro Sampaio 2018-06-15 17:32:27 UTC
Affected versions of jquery interpret text/javascript responses from cross-origin ajax requests, and automatically execute the contents in jQuery.globalEval, even when the ajax request doesn't contain the dataType option.

Upstream issue:

https://github.com/jquery/jquery/issues/2432

Upstream patch:

https://github.com/jquery/jquery/commit/b078a62013782c7424a4a61a240c23c4c0b42614

References:

https://nodesecurity.io/advisories/328

Comment 1 Pedro Sampaio 2018-06-15 17:33:35 UTC
Created js-jquery tracking bugs for this issue:

Affects: fedora-all [bug 1591855]


Created js-jquery1 tracking bugs for this issue:

Affects: fedora-all [bug 1591859]


Created js-jquery2 tracking bugs for this issue:

Affects: fedora-all [bug 1591857]


Created python-XStatic-jQuery tracking bugs for this issue:

Affects: epel-7 [bug 1591863]
Affects: fedora-all [bug 1591858]


Created python-tw2-jquery tracking bugs for this issue:

Affects: epel-all [bug 1591860]
Affects: fedora-all [bug 1591856]


Created rubygem-jquery-rails tracking bugs for this issue:

Affects: fedora-all [bug 1591862]

Comment 15 errata-xmlrpc 2020-03-26 15:47:11 UTC
This issue has been addressed in the following products:

  Red Hat Fuse 7.6.0

Via RHSA-2020:0983 https://access.redhat.com/errata/RHSA-2020:0983

Comment 16 Product Security DevOps Team 2020-03-26 16:31:51 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2017-16012

Comment 18 Yadnyawalk Tale 2020-04-20 13:17:11 UTC
Satellite 5.8 is currently in Maintenance Support 2 phase that means we're addressing only Critical and selected Important Impact Security Advisories.
Reference -- https://access.redhat.com/support/policy/updates/satellite