Red Hat Security Advisory: python-XStatic-jQuery security update

Fixed packages 1

Vulnerabilities 1

• Medium 6.1
  CVE-2019-11358 Public exploit EPSS 87%

  XSS in jQuery as used in Drupal, Backdrop CMS, and other products

  jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Obj…

  mediawiki mediawiki django drupal/core Debian Ubuntu Azure Linux Alpine npm Packagist Maven PyPI NuGet RubyGems
  Apr 19, 2019

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1701972
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_5581.json
• report
  https://access.redhat.com/security/cve/CVE-2019-11358
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-11358
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-11358
• article
  https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/
• article
  https://www.drupal.org/sa-core-2019-006