Bug 1686454 (CVE-2019-8331)
| Summary: | CVE-2019-8331 bootstrap: XSS in the tooltip or popover data-template attribute | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Laura Pardo <lpardo> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | abokovoy, aileenc, amasferr, apevec, asoldano, bbaranow, bbuckingham, bcourt, bdettelb, bmaxwell, brian.stansberry, btotty, cdewolf, chazlett, cheimes, darran.lofthouse, dblechte, dfediuck, dkreling, dosoudil, drieden, eedri, eglynn, ehelms, fjuma, frenaud, gmalinko, iweiss, janstey, jjoyce, jochrist, jpavlik, jschorr, jshepherd, jsherril, jwon, krathod, lgao, lhh, lzap, mburns, mgarciac, mgoldboi, mhulan, michal.skrivanek, mkosek, mkudlej, mmccune, mosmerov, msochure, msvehla, myarboro, nmoumoul, nwallace, omachace, orabin, pcreech, pdelbell, pdrozd, pjindal, pmackay, rchan, rcritten, rhcs-maint, rhos-maint, rstancel, sbonazzo, security-response-team, sgratch, sherold, smaestri, spower, sthorger, tjochec, tomckay, tom.jenkinson, tscherf, twoerner, yturgema |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | bootstrap 4.3.1 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A cross-site scripting vulnerability was discovered in bootstrap. If an attacker could control the data given to tooltip or popover, they could inject HTML or Javascript into the rendered page when tooltip or popover events fired.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-07-12 13:06:45 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1686455, 1686456, 1686457, 1686458, 1692159, 1692160, 1692161, 1692162, 1692163, 1692164, 1740984, 1740985, 1753842, 1811962, 1811963, 1811964, 1811965, 2106606, 2106607, 2124971, 2124972, 2124973 | ||
| Bug Blocks: | 1686483 | ||
|
Description
Laura Pardo
2019-03-07 13:49:23 UTC
Created python-XStatic-Bootstrap-SCSS tracking bugs for this issue: Affects: epel-7 [bug 1686455] Affects: fedora-all [bug 1686456] Affects: openstack-rdo [bug 1686458] Created rubygem-bootstrap-sass tracking bugs for this issue: Affects: fedora-all [bug 1686457] Red Hat OpenStack Platform versions 8, 9, 10, 13, & 14 are affected by this vulnerability. This issue has been addressed in the following products: Red Hat Single Sign-On 7.3.2 zip Via RHSA-2019:1456 https://access.redhat.com/errata/RHSA-2019:1456 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2019-8331 Statement: Red Hat CloudForms 4.6 and newer versions include the vulnerable component, but there is no risk of exploitation since there is no possible vector to access the vulnerability. Older Red Hat CloudForms versions don't use the vulnerable component at all. This issue has been addressed in the following products: Red Hat Virtualization Engine 4.3 Via RHSA-2019:3023 https://access.redhat.com/errata/RHSA-2019:3023 This issue has been addressed in the following products: Red Hat Virtualization Engine 4.3 Via RHSA-2019:3024 https://access.redhat.com/errata/RHSA-2019:3024 This issue has been addressed in the following products: Red Hat Virtualization Engine 4.4 Via RHSA-2020:3247 https://access.redhat.com/errata/RHSA-2020:3247 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2020:3936 https://access.redhat.com/errata/RHSA-2020:3936 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2020:4670 https://access.redhat.com/errata/RHSA-2020:4670 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2020:4847 https://access.redhat.com/errata/RHSA-2020:4847 This issue has been addressed in the following products: Red Hat OpenStack Platform 13.0 (Queens) Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.6 EUS Via RHSA-2020:5571 https://access.redhat.com/errata/RHSA-2020:5571 Created qpid-dispatch tracking bugs for this issue: Affects: openstack-rdo [bug 2124971] This issue has been addressed in the following products: Red Hat Fuse 7.11.1 Via RHSA-2022:8652 https://access.redhat.com/errata/RHSA-2022:8652 This issue has been addressed in the following products: Red Hat OpenStack Platform 16.2 Via RHSA-2022:8848 https://access.redhat.com/errata/RHSA-2022:8848 This issue has been addressed in the following products: Red Hat OpenStack Platform 16.1 Via RHSA-2022:8865 https://access.redhat.com/errata/RHSA-2022:8865 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 Via RHSA-2023:0553 https://access.redhat.com/errata/RHSA-2023:0553 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 Via RHSA-2023:0552 https://access.redhat.com/errata/RHSA-2023:0552 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 Via RHSA-2023:0554 https://access.redhat.com/errata/RHSA-2023:0554 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform Via RHSA-2023:0556 https://access.redhat.com/errata/RHSA-2023:0556 |