-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Wed, 13 Sep 2023 11:43:01 +0200 Source: ruby-rails-html-sanitizer Architecture: source Version: 1.0.4-1+deb10u2 Distribution: buster-security Urgency: high Maintainer: Debian Ruby Extras Maintainers <pkg-ruby-extras-maintainers@lists.alioth.debian.org> Changed-By: Sylvain Beucler <beuc@debian.org> Closes: 1027153 Changes: ruby-rails-html-sanitizer (1.0.4-1+deb10u2) buster-security; urgency=high . * Non-maintainer upload by the LTS Security Team. (Closes: #1027153) * CVE-2022-23517: Certain configurations use an inefficient regular expression that is susceptible to excessive backtracking when attempting to sanitize certain SVG attributes. This may lead to a denial of service through CPU resource consumption. Fix requires ruby-loofah >= 2.2.3-1+deb10u2. * CVE-2022-23518: cross-site scripting via data URIs when used in combination with Loofah. Fix requires ruby-loofah >= 2.2.3-1+deb10u2. * CVE-2022-23519: XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags in either of the following ways: allow both "math" and "style" elements, or allow both "svg" and "style" elements. Same fix as CVE-2022-23520. * CVE-2022-23520: XSS vulnerability with certain configurations of Rails::Html::Sanitizer due to an incomplete fix of CVE-2022-32209. Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags to allow both "select" and "style" elements. Code is only impacted if allowed tags are being overridden. Fix requires ruby-loofah >= 2.2.3-1+deb10u2. * Drop patch for CVE 2022-32209, replaced by the one for CVE-2022-23519/23520. Checksums-Sha1: dc0b50a213f03870b5945f0c6b2d02000fa4c443 2315 ruby-rails-html-sanitizer_1.0.4-1+deb10u2.dsc bc5b5d808c8c432f9e7e4b444a880521f09e5a8d 5804 ruby-rails-html-sanitizer_1.0.4-1+deb10u2.debian.tar.xz a2f0d15b5132942650333bb153b85d0588e97a1e 10692 ruby-rails-html-sanitizer_1.0.4-1+deb10u2_all.buildinfo Checksums-Sha256: fd733490e6c65e2a5dc9a6367a25f896952c6bf754aa5c910f0efa8ac912a250 2315 ruby-rails-html-sanitizer_1.0.4-1+deb10u2.dsc fb76ce27e14eefccdec444e9161753c559e5f91db4c9c1cdc865f83b0db40223 5804 ruby-rails-html-sanitizer_1.0.4-1+deb10u2.debian.tar.xz ed06a6bd714a44f6c4fcf7fa437be0d54ac711f6fdd1e53e4fad6e21e344e510 10692 ruby-rails-html-sanitizer_1.0.4-1+deb10u2_all.buildinfo Files: 05219782833801177faa588a178b494f 2315 ruby optional ruby-rails-html-sanitizer_1.0.4-1+deb10u2.dsc 7ec55154551538dd28e82fdb21c1b77a 5804 ruby optional ruby-rails-html-sanitizer_1.0.4-1+deb10u2.debian.tar.xz 7e4be50670e644040e34fbe67add48af 10692 ruby optional ruby-rails-html-sanitizer_1.0.4-1+deb10u2_all.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE1vEOfV7HXWKqBieIDTl9HeUlXjAFAmUBqtkACgkQDTl9HeUl XjChKhAAwYMzC9QEP0UlKKyUIxiQe0nX5yYki1pxa18HKu/1aies7YXVfioYgl36 XJB/3gikzinPv8n1fZXrnguCMWdCizVhkwc+m9JAoD8HHtxfYi7TqWqoCmtfrVCj Zzdn7wZwaRMIju+5UL1Cz2QuPQS+uq/Cgl8lXdQQWeCRdfJOGpSmdZz3Dk1DUk6N jMorVzs0PhJZEJEzHZICjEcsCvGbIjv75cPjqdFlQfy6MQFtIddeh8LIyi+kttbS cInT4uLGqveoWxY+qCdUT27D/J/GsBpnb7IEMw7Ib5+v+D+99w5rYZod5GaqwXkp m6+NCOrNT2ec17ok7GpUwcWQ3gBWeDdjmV22CXdh3z4mgkULghQFC5OAV4JIxO8t GFc52yLmaKP/Hl8pgrdhfXiXftDj5veYsxrOa2quGWwlHwVfr1YtD3nIaBaEXbKl MEWj8vPe1uGQE2JqyEZ9Y1Ju6bLMsCGNNcIg6BntnrqwqPjaKI55guLf3InzNaK3 XxgO9Lf6iCH5vWCXWXDP07Ayc3H1keWrbM8YpFzOOKuvR9QwjSbdESYSMO6yhu4/ vPLrGgeswnP74p3O8E2MI1AqCCKDKQIZm980e48BHbE5LcNk5VIcT0CfXY7vCiO5 eqrDyHDmKytlMP9EZLis9aDdPWvx+ymJXcAvaNjjFuyGSBZBNbE= =lP/2 -----END PGP SIGNATURE-----
