Summary
It was discovered that Sanitize incorrectly handled noscript elements
under certain circumstances. An attacker could possibly use this issue to
execute a cross-site scripting (XSS) attack. This issue only affected
Ubuntu 22.04 LTS. (CVE-2023-23627)
It was discovered that Sanitize incorrectly handled style elements under
certain circumstances. An attacker could possibly use this issue to
execute a cross-site scripting (XSS) attack. (CVE-2023-36823)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | ruby-sanitize | 4.6.6-2.1~0.20.04.2 |
| Ubuntu · 22.04 LTS 22.04:LTS | ruby-sanitize | 6.0.0-1ubuntu0.1 |
Vulnerabilities 2
-
High 7.1
Sanitize vulnerable to Cross-site Scripting via insufficient neutralization of `style` element content
Sanitize is an allowlist-based HTML and CSS sanitizer. Using carefully crafted input, an attacker may be able to sneak arbitrary HTML and CSS through Sanitize starting with version 3.0.0 and prior to version 6.0.2 when Sanitize is configured to use the built-…
-
Medium 6.1
Sanitize vulnerable to Cross-site Scripting via Improper neutralization of `noscript` element
Sanitize is an allowlist-based HTML and CSS sanitizer. Versions 5.0.0 and later, prior to 6.0.1, are vulnerable to Cross-site Scripting. When Sanitize is configured with a custom allowlist that allows `noscript` elements, attackers are able to include arbitra…