Description
In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | twitter-bootstrap3 | 3.4.0+dfsg-1 | — |
| Debian 13 | twitter-bootstrap3 | 3.4.0+dfsg-1 | — |
| Debian 12 | twitter-bootstrap3 | 3.4.0+dfsg-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | twitter-bootstrap4 | No fix yet | — |
| Ubuntu 26.04 LTS | twitter-bootstrap4 | No fix yet | — |
| Ubuntu 25.10 | twitter-bootstrap4 | No fix yet | — |
| Ubuntu 24.04 LTS | twitter-bootstrap4 | No fix yet | — |
| Ubuntu 18.04 LTS | twitter-bootstrap | No fix yet | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | twitter-bootstrap | No fix yet | — |
| Ubuntu Pro 22.04 LTS | twitter-bootstrap4 | No fix yet | — |
| Ubuntu Pro 20.04 LTS | twitter-bootstrap4 | No fix yet | — |
| Ubuntu Pro 18.04 LTS | twitter-bootstrap3 | No fix yet | — |
| Ubuntu Pro 16.04 LTS | twitter-bootstrap3 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | bind-dyndb-ldap | 11.3-1.module+el8.3.0+6993+104f8db0 | RHSA-2020:4670 |
| RHEL 8 | custodia +1 | 0.6.0-3.module+el8.1.0+4098+f286395e | RHSA-2020:4670 |
| RHEL 8 | ipa +9 | 4.8.7-12.module+el8.3.0+8223+6212645f | RHSA-2020:4670 |
| RHEL 8 | ipa-healthcheck +1 | 0.4-6.module+el8.3.0+7711+c4441980 | RHSA-2020:4670 |
| RHEL 8 | ipa-server +4 | 4.8.7-12.module+el8.3.0+8222+c1bff54a | RHSA-2020:4670 |
| RHEL 8 | opendnssec | 2.1.6-2.module+el8.3.0+6580+328a3362 | RHSA-2020:4670 |
| RHEL 8 | python-jwcrypto +1 | 0.5.0-1.module+el8.1.0+4107+4a66eb87 | RHSA-2020:4670 |
| RHEL 8 | python-kdcproxy +1 | 0.4-5.module+el8.2.0+4691+a05b2456 | RHSA-2020:4670 |
| RHEL 8 | python-qrcode +2 | 5.1-12.module+el8.1.0+4107+4a66eb87 | RHSA-2020:4670 |
| RHEL 8 | python-yubico +1 | 1.3.2-9.module+el8.1.0+4107+4a66eb87 | RHSA-2020:4670 |
| RHEL 8 | pyusb +1 | 1.0.0-9.module+el8.1.0+4107+4a66eb87 | RHSA-2020:4670 |
| RHEL 8 | slapi-nis | 0.56.5-4.module+el8.3.0+8222+c1bff54a | RHSA-2020:4670 |
| RHEL 8 | softhsm +1 | 2.6.0-3.module+el8.3.0+6909+fb33717d | RHSA-2020:4670 |
| RHEL 7 | ipa +11 | 4.6.8-5.el7 | RHSA-2020:3936 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhev Manager 4 | ovirt-engine-api-explorer | 0.0.4-1.el7ev | RHBA-2019:1570, RHBA-2019:1076 |
| Red Hat Rhev Manager 4 | ovirt-engine-ui-extensions | 1.0.10-1.el7ev | RHSA-2019:3023 |
| Red Hat OpenStack 13 | python-XStatic-Bootstrap-SCSS +1 | 3.4.1.0-1.el7ost | RHSA-2020:5571 |
| Red Hat Ceph Storage 6 | ceph +26 | 2:17.2.6-148.el9cp | RHSA-2023:5693 |
| Red Hat Ceph Storage 6 | cephadm-ansible | 3.0.0-1.el9cp | RHSA-2023:5693 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | custodia +1 | 0.6.0-3.module_el8.6.0+2881+2f24dc92 | ALSA-2020:4670 |
| AlmaLinux 8 | python3-jwcrypto | 0.5.0-1.module_el8.5.0+2641+983b221b | ALSA-2020:4670 |
| AlmaLinux 8 | python3-kdcproxy | 0.4-5.module_el8.6.0+2881+2f24dc92 | ALSA-2020:4670 |
| AlmaLinux 8 | python3-pyusb | 1.0.0-9.module_el8.5.0+2641+983b221b | ALSA-2020:4670 |
| AlmaLinux 8 | python3-qrcode +1 | 5.1-12.module_el8.5.0+2641+983b221b | ALSA-2020:4670 |
| AlmaLinux 8 | python3-yubico | 1.3.2-9.module_el8.5.0+2641+983b221b | ALSA-2020:4670 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | custodia | 0.6.0-3.module+el8.4.0+429+6bd33fea | RLSA-2020:4670 |
| Rocky Linux 8 | python-jwcrypto | 0.5.0-1.module+el8.4.0+429+6bd33fea | RLSA-2020:4670 |
| Rocky Linux 8 | python-kdcproxy | 0.4-5.module+el8.3.0+244+0b2ae752 | RLSA-2020:4670 |
| Rocky Linux 8 | python-qrcode | 5.1-12.module+el8.4.0+429+6bd33fea | RLSA-2020:4670 |
| Rocky Linux 8 | python-yubico | 1.3.2-9.module+el8.4.0+429+6bd33fea | RLSA-2020:4670 |
| Rocky Linux 8 | pyusb | 1.0.0-9.module+el8.4.0+429+6bd33fea | RLSA-2020:4670 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | ipa-client +10 | 4.6.8-5.amzn2 | ALAS2-2020-1519 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | ceph +3 | No fix yet | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | bind-dyndb-ldap | 11.3-1.module+el8.3.0+7868+2151076c | ELSA-2020-4670 |
| Oracle Linux 8 | custodia +1 | 0.6.0-3.module+el8.3.0+7868+2151076c | ELSA-2020-4670 |
| Oracle Linux 8 | ipa-client +13 | 4.8.7-12.0.1.module+el8.3.0+7868+2151076c | ELSA-2020-4670 |
| Oracle Linux 8 | ipa-healthcheck +1 | 0.4-6.module+el8.3.0+7868+2151076c | ELSA-2020-4670 |
| Oracle Linux 8 | opendnssec | 2.1.6-2.module+el8.3.0+7868+2151076c | ELSA-2020-4670 |
| Oracle Linux 8 | python3-jwcrypto | 0.5.0-1.module+el8.3.0+7868+2151076c | ELSA-2020-4670 |
| Oracle Linux 8 | python3-kdcproxy | 0.4-5.module+el8.3.0+7868+2151076c | ELSA-2020-4670 |
| Oracle Linux 8 | python3-pyusb | 1.0.0-9.module+el8.3.0+7868+2151076c | ELSA-2020-4670 |
| Oracle Linux 8 | python3-qrcode +1 | 5.1-12.module+el8.3.0+7868+2151076c | ELSA-2020-4670 |
| Oracle Linux 8 | python3-yubico | 1.3.2-9.module+el8.3.0+7868+2151076c | ELSA-2020-4670 |
| Oracle Linux 8 | slapi-nis | 0.56.5-4.module+el8.3.0+7868+2151076c | ELSA-2020-4670 |
| Oracle Linux 8 | softhsm +1 | 2.6.0-3.module+el8.3.0+7868+2151076c | ELSA-2020-4670 |
| Oracle Linux 7 | ipa-client +10 | 4.6.8-5.0.1.el7 | ELSA-2020-3936 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.webjars:bootstrap | < 3.4.0 | 3.4.0 | GHSA-ph58-4vrj-w6hr |
| npm | bootstrap | < 3.4.0 | 3.4.0 | GHSA-ph58-4vrj-w6hr |
| npm | bootstrap-sass | < 3.4.0 | 3.4.0 | GHSA-ph58-4vrj-w6hr |
| NuGet | bootstrap | < 3.4.0 | 3.4.0 | GHSA-ph58-4vrj-w6hr |
| Packagist | twbs/bootstrap | < 3.4.0 | 3.4.0 | GHSA-ph58-4vrj-w6hr |
| RubyGems | bootstrap | < 3.4.0 | 3.4.0 | GHSA-ph58-4vrj-w6hr |
| RubyGems | bootstrap-sass | < 3.4.0 | 3.4.0 | GHSA-ph58-4vrj-w6hr |
Advisories 15
- ALSA-2020:4670 Moderate: idm:DL1 and idm:client security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2023:5693 Red Hat Security Advisory: Red Hat Ceph Storage 6.1 security, enhancement, and bug fix update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2020:5571 Red Hat Security Advisory: python-XStatic-Bootstrap-SCSS security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2020:4670 Red Hat Security Advisory: idm:DL1 and idm:client security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2020:3936 Red Hat Security Advisory: ipa security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2019:3023 Red Hat Security Advisory: ovirt-engine-ui-extensions security and bug fix update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHBA-2019:1570 Red Hat Bug Fix Advisory: ovirt-engine-api-explorer bug fix and enhancement update for RHV 4.3.4 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHBA-2019:1076 Red Hat Bug Fix Advisory: ovirt-engine-api-explorer bug fix and enhancement update for RHV 4.3 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- WID-SEC-2022-1947 Red Hat Single Sign On: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 8, 2026
- RLSA-2020:4670 Moderate: idm:DL1 and idm:client security, bug fix, and enhancement update Rocky Linux Security Advisories · Feb 4, 2026
- WID-SEC-2023-1369 IBM Business Automation Workflow: Mehrere Schwachstellen ermöglichen Cross-Site Scripting BSI CERT-Bund (WID) · Jun 5, 2023
- WID-SEC-2023-0851 IBM Maximo Asset Management: Mehrere Schwachstellen ermöglichen Cross-Site Scripting BSI CERT-Bund (WID) · Apr 4, 2023
- ELSA-2020-4670 Moderate: idm:DL1 and idm:client security, bug fix, and enhancement update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 10, 2020
- ALAS2-2020-1519 Moderate: ipa security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Oct 22, 2020
- ELSA-2020-3936 Moderate: ipa security, bug fix, and enhancement update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Oct 6, 2020
References
- https://github.com/twbs/bootstrap/issues/27915#issuecomment-452140906
- https://github.com/twbs/bootstrap/issues/27045
- https://blog.getbootstrap.com/2018/12/13/bootstrap-3-4-0/
- https://github.com/twbs/bootstrap/pull/27047
- https://github.com/twbs/bootstrap/issues/27915#issuecomment-452196628
- RHSA-2019:1456 vendor-advisory
- RHBA-2019:1076 vendor-advisory
- RHBA-2019:1570 vendor-advisory
- [superset-dev] 20190926 Re: [VOTE] Release Superset 0.34.1 based on Superset 0.34.1rc1 mailing-list
- RHSA-2019:3023 vendor-advisory
- RHSA-2020:0132 vendor-advisory
- RHSA-2020:0133 vendor-advisory
- [pulsar-commits] 20201215 [GitHub] [pulsar] yanshuchong opened a new issue #8967: CVSS issue list mailing-list
- https://www.tenable.com/security/tns-2021-14