RHSA-2020:4670 — Red Hat Security Advisory: idm:DL1 and idm:client security, bug fix, and enhancement update

Fixed packages 48

Release	Package	Fixed in
Red Hat · RHEL 8 enterprise_linux:8::appstream	bind-dyndb-ldap	0:11.3-1.module+el8.3.0+6993+104f8db0
Red Hat · RHEL 8 enterprise_linux:8::appstream	bind-dyndb-ldap-debuginfo	0:11.3-1.module+el8.3.0+6993+104f8db0
Red Hat · RHEL 8 enterprise_linux:8::appstream	bind-dyndb-ldap-debugsource	0:11.3-1.module+el8.3.0+6993+104f8db0
Red Hat · RHEL 8 enterprise_linux:8::appstream	custodia	0:0.6.0-3.module+el8.1.0+4098+f286395e
Red Hat · RHEL 8 enterprise_linux:8::appstream	ipa	0:4.8.7-12.module+el8.3.0+8223+6212645f
Red Hat · RHEL 8 enterprise_linux:8::appstream	ipa-client	0:4.8.7-12.module+el8.3.0+8223+6212645f
Red Hat · RHEL 8 enterprise_linux:8::appstream	ipa-client-common	0:4.8.7-12.module+el8.3.0+8223+6212645f
Red Hat · RHEL 8 enterprise_linux:8::appstream	ipa-client-debuginfo	0:4.8.7-12.module+el8.3.0+8223+6212645f
Red Hat · RHEL 8 enterprise_linux:8::appstream	ipa-client-epn	0:4.8.7-12.module+el8.3.0+8223+6212645f
Red Hat · RHEL 8 enterprise_linux:8::appstream	ipa-client-samba	0:4.8.7-12.module+el8.3.0+8223+6212645f
Red Hat · RHEL 8 enterprise_linux:8::appstream	ipa-common	0:4.8.7-12.module+el8.3.0+8223+6212645f
Red Hat · RHEL 8 enterprise_linux:8::appstream	ipa-debuginfo	0:4.8.7-12.module+el8.3.0+8223+6212645f
Red Hat · RHEL 8 enterprise_linux:8::appstream	ipa-debugsource	0:4.8.7-12.module+el8.3.0+8223+6212645f
Red Hat · RHEL 8 enterprise_linux:8::appstream	ipa-healthcheck	0:0.4-6.module+el8.3.0+7711+c4441980
Red Hat · RHEL 8 enterprise_linux:8::appstream	ipa-healthcheck-core	0:0.4-6.module+el8.3.0+7711+c4441980
Red Hat · RHEL 8 enterprise_linux:8::appstream	ipa-python-compat	0:4.8.7-12.module+el8.3.0+8223+6212645f
Red Hat · RHEL 8 enterprise_linux:8::appstream	ipa-selinux	0:4.8.7-12.module+el8.3.0+8223+6212645f
Red Hat · RHEL 8 enterprise_linux:8::appstream	ipa-server	0:4.8.7-12.module+el8.3.0+8222+c1bff54a
Red Hat · RHEL 8 enterprise_linux:8::appstream	ipa-server-common	0:4.8.7-12.module+el8.3.0+8222+c1bff54a
Red Hat · RHEL 8 enterprise_linux:8::appstream	ipa-server-debuginfo	0:4.8.7-12.module+el8.3.0+8222+c1bff54a
Red Hat · RHEL 8 enterprise_linux:8::appstream	ipa-server-dns	0:4.8.7-12.module+el8.3.0+8222+c1bff54a
Red Hat · RHEL 8 enterprise_linux:8::appstream	ipa-server-trust-ad	0:4.8.7-12.module+el8.3.0+8222+c1bff54a
Red Hat · RHEL 8 enterprise_linux:8::appstream	ipa-server-trust-ad-debuginfo	0:4.8.7-12.module+el8.3.0+8222+c1bff54a
Red Hat · RHEL 8 enterprise_linux:8::appstream	opendnssec	0:2.1.6-2.module+el8.3.0+6580+328a3362
Red Hat · RHEL 8 enterprise_linux:8::appstream	opendnssec-debuginfo	0:2.1.6-2.module+el8.3.0+6580+328a3362
Red Hat · RHEL 8 enterprise_linux:8::appstream	opendnssec-debugsource	0:2.1.6-2.module+el8.3.0+6580+328a3362
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-jwcrypto	0:0.5.0-1.module+el8.1.0+4107+4a66eb87
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-kdcproxy	0:0.4-5.module+el8.2.0+4691+a05b2456
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-qrcode	0:5.1-12.module+el8.1.0+4107+4a66eb87
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-yubico	0:1.3.2-9.module+el8.1.0+4107+4a66eb87
Red Hat · RHEL 8 enterprise_linux:8::appstream	python3-custodia	0:0.6.0-3.module+el8.1.0+4098+f286395e
Red Hat · RHEL 8 enterprise_linux:8::appstream	python3-ipaclient	0:4.8.7-12.module+el8.3.0+8223+6212645f
Red Hat · RHEL 8 enterprise_linux:8::appstream	python3-ipalib	0:4.8.7-12.module+el8.3.0+8223+6212645f
Red Hat · RHEL 8 enterprise_linux:8::appstream	python3-ipaserver	0:4.8.7-12.module+el8.3.0+8222+c1bff54a
Red Hat · RHEL 8 enterprise_linux:8::appstream	python3-jwcrypto	0:0.5.0-1.module+el8.1.0+4107+4a66eb87
Red Hat · RHEL 8 enterprise_linux:8::appstream	python3-kdcproxy	0:0.4-5.module+el8.2.0+4691+a05b2456
Red Hat · RHEL 8 enterprise_linux:8::appstream	python3-pyusb	0:1.0.0-9.module+el8.1.0+4107+4a66eb87
Red Hat · RHEL 8 enterprise_linux:8::appstream	python3-qrcode	0:5.1-12.module+el8.1.0+4107+4a66eb87
Red Hat · RHEL 8 enterprise_linux:8::appstream	python3-qrcode-core	0:5.1-12.module+el8.1.0+4107+4a66eb87
Red Hat · RHEL 8 enterprise_linux:8::appstream	python3-yubico	0:1.3.2-9.module+el8.1.0+4107+4a66eb87
Red Hat · RHEL 8 enterprise_linux:8::appstream	pyusb	0:1.0.0-9.module+el8.1.0+4107+4a66eb87
Red Hat · RHEL 8 enterprise_linux:8::appstream	slapi-nis	0:0.56.5-4.module+el8.3.0+8222+c1bff54a
Red Hat · RHEL 8 enterprise_linux:8::appstream	slapi-nis-debuginfo	0:0.56.5-4.module+el8.3.0+8222+c1bff54a
Red Hat · RHEL 8 enterprise_linux:8::appstream	slapi-nis-debugsource	0:0.56.5-4.module+el8.3.0+8222+c1bff54a
Red Hat · RHEL 8 enterprise_linux:8::appstream	softhsm	0:2.6.0-3.module+el8.3.0+6909+fb33717d
Red Hat · RHEL 8 enterprise_linux:8::appstream	softhsm-debuginfo	0:2.6.0-3.module+el8.3.0+6909+fb33717d
Red Hat · RHEL 8 enterprise_linux:8::appstream	softhsm-debugsource	0:2.6.0-3.module+el8.3.0+6909+fb33717d
Red Hat · RHEL 8 enterprise_linux:8::appstream	softhsm-devel	0:2.6.0-3.module+el8.3.0+6909+fb33717d

Vulnerabilities 10

Medium 6.9

CVE-2020-11022 Public exploit EPSS 99%

jQuery has a potential XSS vulnerability

In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3…

jquery jQuery keycloak-26.6-iamguarded-compat drupal7 Debian Ubuntu Alpine Wolfi npm Packagist Maven NuGet RubyGems

Apr 29, 2020
Medium 6.1

CVE-2015-9251 Public exploit EPSS 30%

Cross-Site Scripting (XSS) in jquery

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

ruby ceph jquery-rails org.webjars.npm:jquery Ubuntu Azure Linux Alpine npm Maven NuGet RubyGems

Jan 18, 2018
Medium 6.1

CVE-2016-10735 Public exploit

Bootstrap Cross-site Scripting vulnerability

In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041.

bootstrap twitter-bootstrap3 twitter-bootstrap3 twbs/bootstrap Debian Ubuntu npm Packagist Maven NuGet RubyGems

Jan 9, 2019
Medium 6.1

CVE-2018-14040 Public exploit

Bootstrap vulnerable to Cross-Site Scripting (XSS)

In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.

reaper twitter-bootstrap3 bootstrap twitter-bootstrap3 Debian Ubuntu Azure Linux npm Packagist Maven NuGet RubyGems

Jul 13, 2018
Medium 6.1

CVE-2018-14042 Public exploit

Bootstrap Cross-site Scripting vulnerability

In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.

ceph fluent-bit pytorch twitter-bootstrap3 Debian Ubuntu Azure Linux npm Packagist Maven NuGet RubyGems

Jul 13, 2018
Medium 6.1

CVE-2018-20676

XSS vulnerability that affects bootstrap

In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute.

twitter-bootstrap3 bootstrap twitter-bootstrap3 org.webjars:bootstrap Debian Ubuntu npm Packagist Maven NuGet RubyGems

Jan 9, 2019
Medium 6.1

CVE-2018-20677

bootstrap Cross-site Scripting vulnerability

In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property.

ceph fluent-bit pytorch twitter-bootstrap3 Debian Ubuntu Azure Linux npm Packagist Maven NuGet RubyGems

Jan 9, 2019
Medium 6.1

CVE-2019-11358 Public exploit EPSS 87%

XSS in jQuery as used in Drupal, Backdrop CMS, and other products

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Obj…

mediawiki mediawiki django drupal/core Debian Ubuntu Azure Linux Alpine npm Packagist Maven PyPI NuGet RubyGems

Apr 19, 2019
Medium 6.1

CVE-2019-8331 Public exploit EPSS 16%

Bootstrap Vulnerable to Cross-Site Scripting

In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.

ceph fluent-bit pytorch ntopng Debian Ubuntu Azure Linux npm Packagist Maven NuGet RubyGems

Feb 20, 2019
Medium 5.3

CVE-2020-1722

A flaw was found in all ipa versions 4.x.x through 4.8.0. When sending a very long password (>= 1,000,000 characters) t…

Red Hat ipa freeipa freeipa Debian Ubuntu

Apr 27, 2020

References

article
https://access.redhat.com/security/updates/classification/#moderate
article
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.3_release_notes/
report
https://bugzilla.redhat.com/show_bug.cgi?id=1399546
report
https://bugzilla.redhat.com/show_bug.cgi?id=1430365
report
https://bugzilla.redhat.com/show_bug.cgi?id=1488732
report
https://bugzilla.redhat.com/show_bug.cgi?id=1585020
report
https://bugzilla.redhat.com/show_bug.cgi?id=1601614
report
https://bugzilla.redhat.com/show_bug.cgi?id=1601617
report
https://bugzilla.redhat.com/show_bug.cgi?id=1651577
report
https://bugzilla.redhat.com/show_bug.cgi?id=1668082
report
https://bugzilla.redhat.com/show_bug.cgi?id=1668089
report
https://bugzilla.redhat.com/show_bug.cgi?id=1668097
report
https://bugzilla.redhat.com/show_bug.cgi?id=1686454
report
https://bugzilla.redhat.com/show_bug.cgi?id=1701233
report
https://bugzilla.redhat.com/show_bug.cgi?id=1701972
report
https://bugzilla.redhat.com/show_bug.cgi?id=1746830
report
https://bugzilla.redhat.com/show_bug.cgi?id=1750893
report
https://bugzilla.redhat.com/show_bug.cgi?id=1751295
report
https://bugzilla.redhat.com/show_bug.cgi?id=1757045
report
https://bugzilla.redhat.com/show_bug.cgi?id=1759888
report
https://bugzilla.redhat.com/show_bug.cgi?id=1768156
report
https://bugzilla.redhat.com/show_bug.cgi?id=1777806
report
https://bugzilla.redhat.com/show_bug.cgi?id=1793071
report
https://bugzilla.redhat.com/show_bug.cgi?id=1801698
report
https://bugzilla.redhat.com/show_bug.cgi?id=1802471
report
https://bugzilla.redhat.com/show_bug.cgi?id=1809835
report
https://bugzilla.redhat.com/show_bug.cgi?id=1810154
report
https://bugzilla.redhat.com/show_bug.cgi?id=1810179
report
https://bugzilla.redhat.com/show_bug.cgi?id=1813330
report
https://bugzilla.redhat.com/show_bug.cgi?id=1816784
report
https://bugzilla.redhat.com/show_bug.cgi?id=1818765
report
https://bugzilla.redhat.com/show_bug.cgi?id=1818877
report
https://bugzilla.redhat.com/show_bug.cgi?id=1828406
report
https://bugzilla.redhat.com/show_bug.cgi?id=1831732
report
https://bugzilla.redhat.com/show_bug.cgi?id=1831935
report
https://bugzilla.redhat.com/show_bug.cgi?id=1832331
report
https://bugzilla.redhat.com/show_bug.cgi?id=1833266
report
https://bugzilla.redhat.com/show_bug.cgi?id=1834264
report
https://bugzilla.redhat.com/show_bug.cgi?id=1834909

Red Hat Security Advisory: idm:DL1 and idm:client security, bug fix, and enhancement update

Fixed packages 48

Vulnerabilities 10

jQuery has a potential XSS vulnerability

Cross-Site Scripting (XSS) in jquery

Bootstrap Cross-site Scripting vulnerability

Bootstrap vulnerable to Cross-Site Scripting (XSS)

Bootstrap Cross-site Scripting vulnerability

XSS vulnerability that affects bootstrap

bootstrap Cross-site Scripting vulnerability

XSS in jQuery as used in Drupal, Backdrop CMS, and other products

Bootstrap Vulnerable to Cross-Site Scripting

A flaw was found in all ipa versions 4.x.x through 4.8.0. When sending a very long password (>= 1,000,000 characters) t…

References