Skip to content
OpenAdvisories
Medium · 6.8 CVE-2020-26298 EUVD-2021-0511GHSA-q3wr-qw3g-3p4h

Injection in Redcarpet

Published Jan 11, 2021 · Updated Feb 13, 2025 · Assigned by GitHub_M

Vendor: vmg Product: redcarpet Package: redcarpet Package: ruby-redcarpet Ecosystem: Debian Ecosystem: RubyGems

Description

Redcarpet is a Ruby library for Markdown processing. In Redcarpet before version 3.5.1, there is an injection vulnerability which can enable a cross-site scripting attack. In affected versions no HTML escaping was being performed when processing quotes. This applies even when the `:escape_html` option was being used. This is fixed in version 3.5.1 by the referenced commit.

Affected products

VendorProductAffectedFixed
vmg redcarpet < 3.5.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 ruby-redcarpet 3.5.1-1 —
Debian 13 ruby-redcarpet 3.5.1-1 —
Debian 12 ruby-redcarpet 3.5.1-1 —
Debian 10 ruby-redcarpet 3.4.0-4+deb10u1 DSA-4831-1
Debian 9 ruby-redcarpet 3.3.4-2+deb9u1 DLA-2526-1

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SUSE OpenStack Cloud Crowbar 9 crowbar-openstack 6.0+git.1630614261.26948f746-3.37.2 SUSE-SU-2021:3729-1
SUSE OpenStack Cloud Crowbar 9 influxdb 1.3.8-4.6.1 SUSE-SU-2021:3729-1
SUSE OpenStack Cloud Crowbar 9 kibana 4.6.6-4.12.1 SUSE-SU-2021:3729-1
SUSE OpenStack Cloud Crowbar 9 openstack-cinder 13.0.10~dev23-3.31.2 SUSE-SU-2021:3729-1
SUSE OpenStack Cloud Crowbar 9 openstack-ec2-api 7.1.1~dev6-3.3.2 SUSE-SU-2021:3729-1
SUSE OpenStack Cloud Crowbar 9 openstack-heat-gbp 12.0.1~dev4-3.6.1 SUSE-SU-2021:3729-1
SUSE OpenStack Cloud Crowbar 9 openstack-heat-templates 0.0.0+git.1628179051.7d761bff-3.12.1 SUSE-SU-2021:3729-1
SUSE OpenStack Cloud Crowbar 9 openstack-horizon-plugin-gbp-ui 12.0.1~dev5-3.6.1 SUSE-SU-2021:3729-1
SUSE OpenStack Cloud Crowbar 9 openstack-keystone 14.2.1~dev7-3.25.2 SUSE-SU-2021:3729-1
SUSE OpenStack Cloud Crowbar 9 openstack-neutron-gbp 14.0.1~dev19-3.28.1 SUSE-SU-2021:3729-1
SUSE OpenStack Cloud Crowbar 9 openstack-nova 18.3.1~dev91-3.40.1 SUSE-SU-2021:3729-1
SUSE OpenStack Cloud Crowbar 9 python-eventlet 0.20.0-8.3.1 SUSE-SU-2021:3729-1
SUSE OpenStack Cloud Crowbar 9 rubygem-puma 2.16.0-4.15.1 SUSE-SU-2021:3729-1
SUSE OpenStack Cloud Crowbar 9 rubygem-redcarpet 3.2.3-4.3.1 SUSE-SU-2021:3729-1
SUSE OpenStack Cloud Crowbar 8 documentation-suse-openstack-cloud-deployment +3 8.20210806-1.35.1 SUSE-SU-2021:3728-1
SUSE OpenStack Cloud Crowbar 8 openstack-ec2-api 5.0.1~dev12-4.9.1 SUSE-SU-2021:3728-1
SUSE OpenStack Cloud Crowbar 8 openstack-heat-templates 0.0.0+git.1628179051.7d761bf-3.24.1 SUSE-SU-2021:3728-1
SUSE OpenStack Cloud Crowbar 8 python-Django 1.11.29-3.28.1 SUSE-SU-2021:3728-1
SUSE OpenStack Cloud Crowbar 8 python-monasca-common 2.3.1~dev4-4.9.1 SUSE-SU-2021:3728-1
SUSE OpenStack Cloud Crowbar 8 rubygem-puma 2.16.0-3.15.1 SUSE-SU-2021:3728-1
SUSE OpenStack Cloud Crowbar 8 rubygem-redcarpet 3.2.3-3.3.1 SUSE-SU-2021:3728-1
SUSE OpenStack Cloud 9 ardana-ansible 9.0+git.1628097238.f6cbb0e-3.29.1 SUSE-SU-2021:3729-1
SUSE OpenStack Cloud 9 ardana-monasca 9.0+git.1627995376.30bdf85-3.25.1 SUSE-SU-2021:3729-1
SUSE OpenStack Cloud 9 influxdb 1.3.8-4.6.1 SUSE-SU-2021:3729-1
SUSE OpenStack Cloud 9 kibana 4.6.6-4.12.1 SUSE-SU-2021:3729-1
SUSE OpenStack Cloud 9 openstack-cinder 13.0.10~dev23-3.31.2 SUSE-SU-2021:3729-1
SUSE OpenStack Cloud 9 openstack-ec2-api 7.1.1~dev6-3.3.2 SUSE-SU-2021:3729-1
SUSE OpenStack Cloud 9 openstack-heat-gbp 12.0.1~dev4-3.6.1 SUSE-SU-2021:3729-1
SUSE OpenStack Cloud 9 openstack-heat-templates 0.0.0+git.1628179051.7d761bff-3.12.1 SUSE-SU-2021:3729-1
SUSE OpenStack Cloud 9 openstack-horizon-plugin-gbp-ui 12.0.1~dev5-3.6.1 SUSE-SU-2021:3729-1
SUSE OpenStack Cloud 9 openstack-keystone 14.2.1~dev7-3.25.2 SUSE-SU-2021:3729-1
SUSE OpenStack Cloud 9 openstack-neutron-gbp 14.0.1~dev19-3.28.1 SUSE-SU-2021:3729-1
SUSE OpenStack Cloud 9 openstack-nova 18.3.1~dev91-3.40.1 SUSE-SU-2021:3729-1
SUSE OpenStack Cloud 9 python-eventlet 0.20.0-8.3.1 SUSE-SU-2021:3729-1
SUSE OpenStack Cloud 9 venv-openstack-barbican 7.0.1~dev24-3.25.1 SUSE-SU-2021:3729-1
SUSE OpenStack Cloud 9 venv-openstack-cinder 13.0.10~dev23-3.28.1 SUSE-SU-2021:3729-1
SUSE OpenStack Cloud 9 venv-openstack-designate 7.0.2~dev2-3.25.1 SUSE-SU-2021:3729-1
SUSE OpenStack Cloud 9 venv-openstack-glance 17.0.1~dev30-3.23.1 SUSE-SU-2021:3729-1
SUSE OpenStack Cloud 9 venv-openstack-heat 11.0.4~dev4-3.25.1 SUSE-SU-2021:3729-1
SUSE OpenStack Cloud 9 venv-openstack-horizon 14.1.1~dev11-4.29.1 SUSE-SU-2021:3729-1
SUSE OpenStack Cloud 9 venv-openstack-ironic 11.1.5~dev17-4.23.1 SUSE-SU-2021:3729-1
SUSE OpenStack Cloud 9 venv-openstack-keystone 14.2.1~dev7-3.26.1 SUSE-SU-2021:3729-1
SUSE OpenStack Cloud 9 venv-openstack-magnum 7.2.1~dev1-4.25.1 SUSE-SU-2021:3729-1
SUSE OpenStack Cloud 9 venv-openstack-manila 7.4.2~dev60-3.31.1 SUSE-SU-2021:3729-1
SUSE OpenStack Cloud 9 venv-openstack-monasca 2.7.1~dev10-3.23.1 SUSE-SU-2021:3729-1
SUSE OpenStack Cloud 9 venv-openstack-monasca-ceilometer 1.8.2~dev3-3.25.1 SUSE-SU-2021:3729-1
SUSE OpenStack Cloud 9 venv-openstack-neutron 13.0.8~dev164-6.29.1 SUSE-SU-2021:3729-1
SUSE OpenStack Cloud 9 venv-openstack-nova 18.3.1~dev91-3.29.1 SUSE-SU-2021:3729-1
SUSE OpenStack Cloud 9 venv-openstack-octavia 3.2.3~dev7-4.25.1 SUSE-SU-2021:3729-1
SUSE OpenStack Cloud 9 venv-openstack-sahara 9.0.2~dev15-3.25.1 SUSE-SU-2021:3729-1
SUSE OpenStack Cloud 9 venv-openstack-swift 2.19.2~dev48-2.20.1 SUSE-SU-2021:3729-1
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SUSE OpenStack Cloud 8 ardana-ansible 8.0+git.1632499354.a56668f-3.82.1 SUSE-SU-2021:3728-1
SUSE OpenStack Cloud 8 ardana-monasca 8.0+git.1627997000.6c3bc04-3.30.1 SUSE-SU-2021:3728-1
SUSE OpenStack Cloud 8 documentation-suse-openstack-cloud-user +8 8.20210806-1.35.1 SUSE-SU-2021:3728-1
SUSE OpenStack Cloud 8 openstack-ec2-api 5.0.1~dev12-4.9.1 SUSE-SU-2021:3728-1
SUSE OpenStack Cloud 8 openstack-heat-templates 0.0.0+git.1628179051.7d761bf-3.24.1 SUSE-SU-2021:3728-1
SUSE OpenStack Cloud 8 python-Django 1.11.29-3.28.1 SUSE-SU-2021:3728-1
SUSE OpenStack Cloud 8 python-monasca-common 2.3.1~dev4-4.9.1 SUSE-SU-2021:3728-1
SUSE OpenStack Cloud 8 venv-openstack-heat 9.0.8~dev22-12.35.1 SUSE-SU-2021:3728-1
SUSE OpenStack Cloud 8 venv-openstack-horizon 12.0.5~dev6-14.38.2 SUSE-SU-2021:3728-1
SUSE OpenStack Cloud 8 venv-openstack-monasca 2.2.2~dev1-11.30.1 SUSE-SU-2021:3728-1
SUSE HPE Helion OpenStack 8 ardana-ansible 8.0+git.1632499354.a56668f-3.82.1 SUSE-SU-2021:3728-1
SUSE HPE Helion OpenStack 8 ardana-monasca 8.0+git.1627997000.6c3bc04-3.30.1 SUSE-SU-2021:3728-1
SUSE HPE Helion OpenStack 8 documentation-hpe-helion-openstack-user +5 8.20210806-1.35.1 SUSE-SU-2021:3728-1
SUSE HPE Helion OpenStack 8 openstack-ec2-api 5.0.1~dev12-4.9.1 SUSE-SU-2021:3728-1
SUSE HPE Helion OpenStack 8 openstack-heat-templates 0.0.0+git.1628179051.7d761bf-3.24.1 SUSE-SU-2021:3728-1
SUSE HPE Helion OpenStack 8 python-Django 1.11.29-3.28.1 SUSE-SU-2021:3728-1
SUSE HPE Helion OpenStack 8 python-monasca-common 2.3.1~dev4-4.9.1 SUSE-SU-2021:3728-1
SUSE HPE Helion OpenStack 8 venv-openstack-heat 9.0.8~dev22-12.35.1 SUSE-SU-2021:3728-1
SUSE HPE Helion OpenStack 8 venv-openstack-horizon-hpe 12.0.5~dev6-14.38.1 SUSE-SU-2021:3728-1
SUSE HPE Helion OpenStack 8 venv-openstack-monasca 2.2.2~dev1-11.30.1 SUSE-SU-2021:3728-1

Affected packages

EcosystemPackageAffectedFixedRecord
RubyGems redcarpet < 3.5.1 3.5.1 GHSA-q3wr-qw3g-3p4h

Advisories 4

References