Bug 2153744 (CVE-2022-23519)

Summary:	CVE-2022-23519 rubygem-rails-html-sanitizer: Cross site scripting vulnerability with certain configurations
Product:	[Other] Security Response	Reporter:	ybuenos
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	amackenz, amasferr, bbuckingham, bcourt, btotty, chazlett, ehelms, jsherril, lzap, mhulan, mkudlej, nmoumoul, orabin, pcreech, rchan, tjochec
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	rubygem-rails-html-sanitizer 1.4.4	Doc Type:	---
Doc Text:	A Cross-site scripting vulnerability was found in rails-html-sanitizer. Certain configurations of rails-html-sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-05-03 23:13:17 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2153747, 2153724, 2153725, 2153746, 2153748, 2153749
Bug Blocks:	2153085

Description ybuenos 2022-12-15 10:42:55 UTC

Prior to version 1.4.4, a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags in either of the following ways: allow both "math" and "style" elements, or allow both "svg" and "style" elements. Code is only impacted if allowed tags are being overridden. . This issue is fixed in version 1.4.4. All users overriding the allowed tags to include "math" or "svg" and "style" should either upgrade or use the following workaround immediately: Remove "style" from the overridden allowed tags, or remove "math" and "svg" from the overridden allowed tags.

Comment 1 ybuenos 2022-12-15 10:44:26 UTC

Created rubygem-rails-html-sanitizer tracking bugs for this issue:

Affects: fedora-36 [bug 2153746]
Affects: fedora-37 [bug 2153747]

Comment 5 errata-xmlrpc 2023-05-03 13:20:20 UTC

This issue has been addressed in the following products:

  Red Hat Satellite 6.13 for RHEL 8

Via RHSA-2023:2097 https://access.redhat.com/errata/RHSA-2023:2097

Comment 6 Product Security DevOps Team 2023-05-03 23:13:14 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-23519