Summary
It was discovered that Loofah does not properly sanitize JavaScript in
sanitized output. An attacker could possibly use this issue to perform
XSS attacks. (CVE-2019-15587)
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | ruby-loofah | 2.0.3-2+deb9u3build0.16.04.1 |
Vulnerabilities 1
-
Medium 5.4
Loofah Allows Cross-site Scripting
In the Loofah gem for Ruby through v2.3.0 unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.
References
-
report
https://ubuntu.com/security/CVE-2019-15587