Bug 1086598 (CVE-2018-3741) - VUL-0: CVE-2018-3741: rubygem-rails-html-sanitizer: XSS vulnerability due to insufficient filtering in scrub_attribute
Summary: VUL-0: CVE-2018-3741: rubygem-rails-html-sanitizer: XSS vulnerability due to ...
Status: RESOLVED FIXED
Alias: CVE-2018-3741
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Manuel Schnitzer
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/202518/
Whiteboard: CVSSv3:SUSE:CVE-2018-3741:6.5:(AV:N/A...
Keywords: Fix_No_Build
Depends on:
Blocks:
 
Reported: 2018-03-23 06:55 UTC by Johannes Segitz
Modified: 2023-01-31 05:21 UTC (History)
9 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments
Upstream patch (5.34 KB, patch)
2018-03-23 06:55 UTC, Johannes Segitz
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Johannes Segitz 2018-03-23 06:55:02 UTC
CVE-2018-3741

From: Rafael Mendonça França

Possible XSS vulnerability in rails-html-sanitizer

There is a possible XSS vulnerability in rails-html-sanitizer. This
vulnerability has been assigned the CVE identifier CVE-2018-3741.

Versions Affected:  1.0.3 or older.
Not affected:       None.
Fixed Versions:     1.0.4

Impact
------
There is a possible XSS vulnerability in rails-html-sanitizer.  The gem allows non-whitelisted
attributes to be present in sanitized output when input with specially-crafted HTML fragments,
and these attributes can lead to an XSS attack on target applications.

This issue is similar to CVE-2018-8048 in Loofah.

All users running an affected release should either upgrade or use one of the
workarounds immediately.

Releases
--------
The FIXED releases are available at the normal locations.

Workarounds
-----------
There are no feasible workarounds for this issue.

Patches
-------
To aid users who aren't able to upgrade immediately we have provided patches for
the two supported release series. They are in git-am format and consist of a
single changeset.

* 1-0-sanitize_attributes.patch - Patch for 1.0 series

Credits
-------
Thanks to Kaarlo Haikonen for reporting this issue and Mike Dalessio for providing the original fix in the Loofah gem.

Affected: Storage 3/4 and Cloud (all SUSE:SLE-12:Update), SLE 15 and Build Service

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-3741
http://seclists.org/oss-sec/2018/q1/262
http://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-3741.html
Comment 1 Johannes Segitz 2018-03-23 06:55:33 UTC
Created attachment 764715 [details]
Upstream patch
Comment 9 Swamp Workflow Management 2018-04-26 13:07:44 UTC
SUSE-SU-2018:1082-1: An update that fixes two vulnerabilities is now available.

Category: security (moderate)
Bug References: 1085967,1086598
CVE References: CVE-2018-3741,CVE-2018-8048
Sources used:
SUSE CaaS Platform ALL (src):    sles12-velum-image-2.0.1-2.7.3
Comment 22 Swamp Workflow Management 2019-08-19 19:11:28 UTC
SUSE-SU-2019:2182-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1086598
CVE References: CVE-2018-3741
Sources used:
SUSE OpenStack Cloud Crowbar 9 (src):    rubygem-rails-html-sanitizer-1.0.3-8.8.1
SUSE OpenStack Cloud Crowbar 8 (src):    rubygem-rails-html-sanitizer-1.0.3-8.8.1
SUSE OpenStack Cloud 7 (src):    rubygem-rails-html-sanitizer-1.0.3-8.8.1
SUSE Enterprise Storage 4 (src):    rubygem-rails-html-sanitizer-1.0.3-8.8.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 25 Swamp Workflow Management 2019-08-23 13:11:03 UTC
SUSE-SU-2019:2209-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1086598
CVE References: CVE-2018-8048
Sources used:
SUSE OpenStack Cloud Crowbar 9 (src):    rubygem-loofah-2.0.2-3.8.1
SUSE OpenStack Cloud Crowbar 8 (src):    rubygem-loofah-2.0.2-3.8.1
SUSE OpenStack Cloud 7 (src):    rubygem-loofah-2.0.2-3.8.1
SUSE Enterprise Storage 4 (src):    rubygem-loofah-2.0.2-3.8.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.