Skip to content
OpenAdvisories
Medium RHSA-2020:0754 1 CVE

Red Hat Security Advisory: novnc security update

Published Sep 13, 2024 · Updated Oct 8, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · OpenStack 13 openstack:13::el7 novnc 0:1.1.0-2.el7ost

Vulnerabilities 1

  • Medium 6.1
    CVE-2017-18635 Public exploit

    Cross-Site Scripting in @novnc/novnc

    An XSS vulnerability was discovered in noVNC before 0.6.2 in which the remote VNC server could inject arbitrary HTML into the noVNC web page via the messages propagated to the status field, such as the VNC server name.

    novnc @novnc/novnc novnc Debian Ubuntu npm

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1484711
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1765660
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0754.json
  • report
    https://access.redhat.com/security/cve/CVE-2017-18635
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2017-18635
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2017-18635
  • article
    https://github.com/novnc/noVNC/releases/tag/v0.6.2