Description
Bodhi 2.9.0 and lower is vulnerable to cross-site scripting resulting in code injection caused by incorrect validation of bug titles.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Fedora Project Infrastructure | Bodhi | unspecified – ≤ 2.9.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | bodhi | < 2.9.1 | 2.9.1 | GHSA-h896-6hcp-gj6c |
| PyPI | bodhi | < 3.3.0 | 3.3.0 | PYSEC-2019-150 |