Bug 1686454 (CVE-2019-8331) - CVE-2019-8331 bootstrap: XSS in the tooltip or popover data-template attribute
Summary: CVE-2019-8331 bootstrap: XSS in the tooltip or popover data-template attribute
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2019-8331
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1686455 1686458 2124971 1686456 1686457 Red Hat1692159 Red Hat1692160 Red Hat1692161 Red Hat1692162 Red Hat1692163 Red Hat1692164 Engineering1740984 Engineering1740985 Engineering1753842 Engineering1811962 Engineering1811963 Engineering1811964 Engineering1811965 Red Hat2106606 Red Hat2106607 Red Hat2124972 Red Hat2124973
Blocks: Embargoed1686483
TreeView+ depends on / blocked
 
Reported: 2019-03-07 13:49 UTC by Laura Pardo
Modified: 2023-03-01 18:38 UTC (History)
76 users (show)

Fixed In Version: bootstrap 4.3.1
Doc Type: If docs needed, set a value
Doc Text:
A cross-site scripting vulnerability was discovered in bootstrap. If an attacker could control the data given to tooltip or popover, they could inject HTML or Javascript into the rendered page when tooltip or popover events fired.
Clone Of:
Environment:
Last Closed: 2019-07-12 13:06:45 UTC

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2019:1456 0 None None None 2019-06-11 15:32:28 UTC
Red Hat Product Errata RHSA-2019:3023 0 None None None 2019-10-10 15:38:50 UTC
Red Hat Product Errata RHSA-2019:3024 0 None None None 2019-10-10 15:38:55 UTC
Red Hat Product Errata RHSA-2020:3247 0 None None None 2020-08-04 13:15:38 UTC
Red Hat Product Errata RHSA-2020:3936 0 None None None 2020-09-29 19:57:46 UTC
Red Hat Product Errata RHSA-2020:4670 0 None None None 2020-11-04 02:49:51 UTC
Red Hat Product Errata RHSA-2020:4847 0 None None None 2020-11-04 03:14:41 UTC
Red Hat Product Errata RHSA-2020:5571 0 None None None 2020-12-16 13:52:00 UTC
Red Hat Product Errata RHSA-2022:8652 0 None None None 2022-11-28 14:39:33 UTC
Red Hat Product Errata RHSA-2022:8848 0 None None None 2022-12-07 19:25:26 UTC
Red Hat Product Errata RHSA-2022:8865 0 None None None 2022-12-07 20:26:56 UTC
Red Hat Product Errata RHSA-2023:0552 0 None None None 2023-01-31 13:14:32 UTC
Red Hat Product Errata RHSA-2023:0553 0 None None None 2023-01-31 13:10:30 UTC
Red Hat Product Errata RHSA-2023:0554 0 None None None 2023-01-31 13:18:09 UTC
Red Hat Product Errata RHSA-2023:0556 0 None None None 2023-01-31 13:19:19 UTC

Description Laura Pardo 2019-03-07 13:49:23 UTC 
A vulnerability was found in Bootstrap before 4.3.1. An XSS is possible in the tooltip or popover data-template attribute.


References:
https://github.com/twbs/bootstrap/releases/tag/v4.3.1

Upstream Patch:
https://github.com/twbs/bootstrap/pull/28236
Comment 1 Laura Pardo 2019-03-07 13:49:46 UTC 
Created python-XStatic-Bootstrap-SCSS tracking bugs for this issue:

Affects: epel-7 [bug 1686455]
Affects: fedora-all [bug 1686456]
Affects: openstack-rdo [bug 1686458]


Created rubygem-bootstrap-sass tracking bugs for this issue:

Affects: fedora-all [bug 1686457]
Comment 5 Nick Tait 2019-03-24 19:53:10 UTC 
Red Hat OpenStack Platform versions 8, 9, 10, 13, & 14 are affected by this vulnerability.
Comment 9 errata-xmlrpc 2019-06-11 15:32:28 UTC 
This issue has been addressed in the following products:

  Red Hat Single Sign-On 7.3.2 zip

Via RHSA-2019:1456 https://access.redhat.com/errata/RHSA-2019:1456
Comment 10 Product Security DevOps Team 2019-07-12 13:06:45 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-8331
Comment 16 Eric Christensen 2019-09-23 12:32:05 UTC 
Statement:

Red Hat CloudForms 4.6 and newer versions include the vulnerable component, but there is no risk of exploitation since there is no possible vector to access the vulnerability. Older Red Hat CloudForms versions don't use the vulnerable component at all.
Comment 17 errata-xmlrpc 2019-10-10 15:38:49 UTC 
This issue has been addressed in the following products:

  Red Hat Virtualization Engine 4.3

Via RHSA-2019:3023 https://access.redhat.com/errata/RHSA-2019:3023
Comment 18 errata-xmlrpc 2019-10-10 15:38:53 UTC 
This issue has been addressed in the following products:

  Red Hat Virtualization Engine 4.3

Via RHSA-2019:3024 https://access.redhat.com/errata/RHSA-2019:3024
Comment 21 errata-xmlrpc 2020-08-04 13:15:35 UTC 
This issue has been addressed in the following products:

  Red Hat Virtualization Engine 4.4

Via RHSA-2020:3247 https://access.redhat.com/errata/RHSA-2020:3247
Comment 22 errata-xmlrpc 2020-09-29 19:57:44 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:3936 https://access.redhat.com/errata/RHSA-2020:3936
Comment 24 errata-xmlrpc 2020-11-04 02:49:48 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:4670 https://access.redhat.com/errata/RHSA-2020:4670
Comment 25 errata-xmlrpc 2020-11-04 03:14:38 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:4847 https://access.redhat.com/errata/RHSA-2020:4847
Comment 28 errata-xmlrpc 2020-12-16 13:52:29 UTC 
This issue has been addressed in the following products:

  Red Hat OpenStack Platform 13.0 (Queens)
  Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.6 EUS

Via RHSA-2020:5571 https://access.redhat.com/errata/RHSA-2020:5571
Comment 31 Nick Tait 2022-09-07 15:28:59 UTC 
Created qpid-dispatch tracking bugs for this issue:

Affects: openstack-rdo [bug 2124971]
Comment 35 errata-xmlrpc 2022-11-28 14:39:29 UTC 
This issue has been addressed in the following products:

  Red Hat Fuse 7.11.1

Via RHSA-2022:8652 https://access.redhat.com/errata/RHSA-2022:8652
Comment 36 errata-xmlrpc 2022-12-07 19:25:22 UTC 
This issue has been addressed in the following products:

  Red Hat OpenStack Platform 16.2

Via RHSA-2022:8848 https://access.redhat.com/errata/RHSA-2022:8848
Comment 37 errata-xmlrpc 2022-12-07 20:26:53 UTC 
This issue has been addressed in the following products:

  Red Hat OpenStack Platform 16.1

Via RHSA-2022:8865 https://access.redhat.com/errata/RHSA-2022:8865
Comment 38 errata-xmlrpc 2023-01-31 13:10:27 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

Via RHSA-2023:0553 https://access.redhat.com/errata/RHSA-2023:0553
Comment 39 errata-xmlrpc 2023-01-31 13:14:29 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7

Via RHSA-2023:0552 https://access.redhat.com/errata/RHSA-2023:0552
Comment 40 errata-xmlrpc 2023-01-31 13:18:05 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9

Via RHSA-2023:0554 https://access.redhat.com/errata/RHSA-2023:0554
Comment 41 errata-xmlrpc 2023-01-31 13:19:15 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform

Via RHSA-2023:0556 https://access.redhat.com/errata/RHSA-2023:0556
Note You need to log in before you can comment on or make changes to this bug.