Red Hat Security Advisory: pcs security, bug fix, and enhancement update

Fixed packages 4

Vulnerabilities 3

• Medium 6.9
  CVE-2020-11023 Exploited Public exploit EPSS 85%

  Potential XSS vulnerability in jQuery

  In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute unt…

  jquery jQuery drupal7 cacti Debian Ubuntu Alpine npm Packagist Maven NuGet RubyGems
  Apr 29, 2020

  KEV Jan 23, 2025
• Medium 6.1
  CVE-2019-11358 Public exploit EPSS 87%

  XSS in jQuery as used in Drupal, Backdrop CMS, and other products

  jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Obj…

  mediawiki mediawiki django drupal/core Debian Ubuntu Azure Linux Alpine npm Packagist Maven PyPI NuGet RubyGems
  Apr 19, 2019
• Medium 6.1
  CVE-2020-7656 Public exploit

  Cross-Site Scripting in jquery

  jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>" HTML tags that contain a whitespace character, i.e: "</script >", which results in the enclosed script logic to be executed.

  jquery-rails org.webjars.npm:jquery jQuery jquery Ubuntu npm Maven NuGet RubyGems
  May 19, 2020

References

• article
  https://access.redhat.com/security/updates/classification/#low
• article
  https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.5_release_notes/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1290830
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1432097
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1678273
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1690419
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1720221
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1759995
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1841019
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1850004
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1850119
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1854238
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1872378
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1885293
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1885302
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1896458
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1909901
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1922996
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1927384
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1927394
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1930886
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1935594
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1984901
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1991654
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1992668
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1998454
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4142.json
• report
  https://access.redhat.com/security/cve/CVE-2019-11358
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1701972
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-11358
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-11358
• article
  https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/
• article
  https://www.drupal.org/sa-core-2019-006
• report
  https://access.redhat.com/security/cve/CVE-2020-7656
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-7656
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-7656
• report
  https://access.redhat.com/security/cve/CVE-2020-11023
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-11023
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-11023