UBUNTU-CVE-2020-4054

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2020-4054
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2020/UBUNTU-CVE-2020-4054.json
JSON Data
https://api.test.osv.dev/v1/vulns/UBUNTU-CVE-2020-4054
Related
Published
2020-06-16T22:15:00Z
Modified
2025-01-13T10:22:09Z
Severity
  • 7.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
Summary
[none]
Details

In Sanitize (RubyGem sanitize) greater than or equal to 3.0.0 and less than 5.2.1, there is a cross-site scripting vulnerability. When HTML is sanitized using Sanitize's "relaxed" config, or a custom config that allows certain elements, some content in a math or svg element may not be sanitized correctly even if math and svg are not in the allowlist. You are likely to be vulnerable to this issue if you use Sanitize's relaxed config or a custom config that allows one or more of the following HTML elements: iframe, math, noembed, noframes, noscript, plaintext, script, style, svg, xmp. Using carefully crafted input, an attacker may be able to sneak arbitrary HTML through Sanitize, potentially resulting in XSS (cross-site scripting) or other undesired behavior when that HTML is rendered in a browser. This has been fixed in 5.2.1.

References

Affected packages

Ubuntu:Pro:16.04:LTS / ruby-sanitize

Package

Name
ruby-sanitize
Purl
pkg:deb/ubuntu/ruby-sanitize@2.1.0-2+deb9u1build0.16.04.1?arch=source&distro=esm-apps/xenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.1.0-1
2.1.0-2
2.1.0-2+deb9u1build0.16.04.1

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:Pro:18.04:LTS / ruby-sanitize

Package

Name
ruby-sanitize
Purl
pkg:deb/ubuntu/ruby-sanitize@2.1.0-2+deb9u1build0.18.04.1?arch=source&distro=esm-apps/bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.1.0-2
2.1.0-2+deb9u1build0.18.04.1

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:20.04:LTS / ruby-sanitize

Package

Name
ruby-sanitize
Purl
pkg:deb/ubuntu/ruby-sanitize@4.6.6-2.1~0.20.04.1?arch=source&distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.6.6-2.1~0.20.04.1

Affected versions

4.*

4.6.6-2

Ecosystem specific 

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "4.6.6-2.1~0.20.04.1",
            "binary_name": "ruby-sanitize"
        }
    ]
}