Bug 2266111 (CVE-2024-21501)
| Summary: | CVE-2024-21501 sanitize-html: Information Exposure when used on the backend | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Rohit Keshri <rkeshri> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | aarif, aprice, bbuckingham, bcourt, bdettelb, btarraso, caswilli, dkuc, ehelms, fjansen, gparvin, hkataria, jchui, jmitchel, jsamir, jsherril, jtanner, kaycoth, kshier, ktsao, lbainbri, lzap, mhulan, mpierce, nboldt, njean, nmoumoul, oezr, omaciel, orabin, owatkins, pahickey, pcreech, psegedy, rchan, rhaigner, rtaniwa, sdawley, sthirugn, tkral, vkrizan, vmugicag |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: |
An information exposure flaw was found in the sanitize-html package, when used on the backend with the style attribute allowed. This issue may allow an attacker to enumerate files in the system, including project dependencies, to gather details about the file system structure and dependencies of the targeted server.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2266114, 2266115, 2266116, 2266117, 2266118, 2266119, 2266120, 2266121 | ||
| Bug Blocks: | 2266122 | ||
|
Description
Rohit Keshri
2024-02-26 18:11:04 UTC
Created glances tracking bugs for this issue: Affects: epel-all [bug 2266114] Affects: fedora-all [bug 2266116] Created golang-github-apache-beam-2 tracking bugs for this issue: Affects: fedora-all [bug 2266117] Created golang-github-prometheus tracking bugs for this issue: Affects: epel-all [bug 2266115] Created jupyterlab tracking bugs for this issue: Affects: fedora-all [bug 2266118] Created python-ipyparallel tracking bugs for this issue: Affects: fedora-all [bug 2266119] Created rstudio tracking bugs for this issue: Affects: fedora-all [bug 2266120] This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.15 Via RHSA-2024:1770 https://access.redhat.com/errata/RHSA-2024:1770 This issue has been solved in RHACM 2.10.1 with this public advisory https://access.redhat.com/errata/RHBA-2024:1793 This issue has been solved in RHACM 2.9.4 via this public advisory https://access.redhat.com/errata/RHBA-2024:3593 This issue has been solved in MCE 2.5.2 via this public advisory https://access.redhat.com/errata/RHBA-2024:1775 This issue has been solved in MCE 2.4.5 via this public advisory https://access.redhat.com/errata/RHBA-2024:3555 |