Skip to content
OpenAdvisories
Medium 1 exploited CVE ALAS2-2021-1626 1 CVE

Moderate: ipa security update (Amazon Linux 2)

Published Apr 20, 2021 · Updated Apr 21, 2021

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-11023: A flaw was found in jQuery. HTML containing <option> elements from untrusted sources are passed, even after sanitizing, to one of jQuery's DOM manipulation methods, which may execute untrusted code. The highest threat from this vulnerability is to data confidentiality and integrity. 1850004: CVE-2020-11023 jquery: Passing HTML containing <option> elements to manipulation methods could result in untrusted code execution

Fixed packages 12

ReleasePackageFixed in
Amazon Linux · 2 ipa-client 0:4.6.8-5.amzn2.4.1
Amazon Linux · 2 ipa-client-common 0:4.6.8-5.amzn2.4.1
Amazon Linux · 2 ipa-common 0:4.6.8-5.amzn2.4.1
Amazon Linux · 2 ipa-debuginfo 0:4.6.8-5.amzn2.4.1
Amazon Linux · 2 ipa-python-compat 0:4.6.8-5.amzn2.4.1
Amazon Linux · 2 ipa-server 0:4.6.8-5.amzn2.4.1
Amazon Linux · 2 ipa-server-common 0:4.6.8-5.amzn2.4.1
Amazon Linux · 2 ipa-server-dns 0:4.6.8-5.amzn2.4.1
Amazon Linux · 2 ipa-server-trust-ad 0:4.6.8-5.amzn2.4.1
Amazon Linux · 2 python2-ipaclient 0:4.6.8-5.amzn2.4.1
Amazon Linux · 2 python2-ipalib 0:4.6.8-5.amzn2.4.1
Amazon Linux · 2 python2-ipaserver 0:4.6.8-5.amzn2.4.1

Vulnerabilities 1

  • Medium 6.9
    CVE-2020-11023 Exploited Public exploit EPSS 85%

    Potential XSS vulnerability in jQuery

    In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute unt…

    jquery jQuery drupal7 cacti Debian Ubuntu Alpine npm Packagist Maven NuGet RubyGems
    KEV Jan 23, 2025

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-11023.html