Bug 1591854 (CVE-2017-16012) - CVE-2017-16012 js-jquery: XSS in responses from cross-origin ajax requests
Summary: CVE-2017-16012 js-jquery: XSS in responses from cross-origin ajax requests
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2017-16012
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: CVE-2015-9251 1399547 1399549 1399551 1399552 1399553 1399554 1399556 1447005 1447011 1447012 1591855 1591856 1591857 1591858 1591859 1591860 1591861 1591862 1591863 1591864 1591865 1593158 1593159 1593160 1593161 1593162 1593163 1593540 1700981 1826674
Blocks: 1591866
TreeView+ depends on / blocked
 
Reported: 2018-06-15 17:32 UTC by Pedro Sampaio
Modified: 2023-09-23 18:10 UTC (History)
69 users (show)

See Also:
Fixed In Version: js-jquery 3.0.0
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2020-03-26 16:31:51 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2020:0983 0 None None None 2020-03-26 15:47:16 UTC

Description Pedro Sampaio 2018-06-15 17:32:27 UTC 
Affected versions of jquery interpret text/javascript responses from cross-origin ajax requests, and automatically execute the contents in jQuery.globalEval, even when the ajax request doesn't contain the dataType option.

Upstream issue:

https://github.com/jquery/jquery/issues/2432

Upstream patch:

https://github.com/jquery/jquery/commit/b078a62013782c7424a4a61a240c23c4c0b42614

References:

https://nodesecurity.io/advisories/328
Comment 1 Pedro Sampaio 2018-06-15 17:33:35 UTC 
Created js-jquery tracking bugs for this issue:

Affects: fedora-all [bug 1591855]


Created js-jquery1 tracking bugs for this issue:

Affects: fedora-all [bug 1591859]


Created js-jquery2 tracking bugs for this issue:

Affects: fedora-all [bug 1591857]


Created python-XStatic-jQuery tracking bugs for this issue:

Affects: epel-7 [bug 1591863]
Affects: fedora-all [bug 1591858]


Created python-tw2-jquery tracking bugs for this issue:

Affects: epel-all [bug 1591860]
Affects: fedora-all [bug 1591856]


Created rubygem-jquery-rails tracking bugs for this issue:

Affects: fedora-all [bug 1591862]
Comment 15 errata-xmlrpc 2020-03-26 15:47:11 UTC 
This issue has been addressed in the following products:

  Red Hat Fuse 7.6.0

Via RHSA-2020:0983 https://access.redhat.com/errata/RHSA-2020:0983
Comment 16 Product Security DevOps Team 2020-03-26 16:31:51 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2017-16012
Comment 18 Yadnyawalk Tale 2020-04-20 13:17:11 UTC 
Satellite 5.8 is currently in Maintenance Support 2 phase that means we're addressing only Critical and selected Important Impact Security Advisories.
Reference -- https://access.redhat.com/support/policy/updates/satellite
Note You need to log in before you can comment on or make changes to this bug.