-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-4358-1 security@xxxxxxxxxx https://www.debian.org/security/ Salvatore Bonaccorso December 27, 2018 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : ruby-sanitize CVE ID : CVE-2018-3740 Debian Bug : 893610 The Shopify Application Security Team discovered that ruby-sanitize, a whitelist-based HTML sanitizer, is prone to a HTML injection vulnerability. A specially crafted HTML fragment can cause to allow non- whitelisted attributes to be used on a whitelisted HTML element. For the stable distribution (stretch), this problem has been fixed in version 2.1.0-2+deb9u1. We recommend that you upgrade your ruby-sanitize packages. For the detailed security status of ruby-sanitize please refer to its security tracker page at: https://security-tracker.debian.org/tracker/ruby-sanitize Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@xxxxxxxxxxxxxxxx -----BEGIN PGP SIGNATURE----- iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAlwkw3FfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2 NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND z0QjiQ/+Kl2eo3dK11Y89BWyA6ABCC0P+1kldIuz/G+o0aJ4LkdojUh0UjOP4zpo liqM84GeNs0YJn+ou6xtm4Tbesv5fm7PeMIlHE98AnuwwRXL/yFIC2X0FcJybQ/I xvPKdcxfKaJCljSreyPT4uMaHf27J5P4QEHH7cIrzoCFvtgIcONfE2MV9wmGwqak JGpKVsW9/U9zIDPrVFGKyWamqqJ2pAIyoAHV/bF2J7b5TGte6hGycpLP4ilwn20h M545+AByYky18UlKdnXJIOazowO463VGpa6/0oAoUH8hGdzkRKREEHGDuhA7CBgW 8Qagb3NM/Gq5tgcrsSoqiVgy4iM+4MEgF8Qy1HwpNXIGYd791xr1ecfelcDfckPb ExTcFPlhfANGsqoMTUyuR9bbgRf6kFipdl/9ApzRNN8dEFatbbfL0ccBr6B/RTBz RD4nhDLV9rEma1/z13Ua08gZqnVoKLQGr32vFjlrq7U33gDBZBr/LAD18j4rHoVw zodDnX4qD9OpUBKkH1tjm0dW4gyhc+jzwe2K+Zl2cdknYrUgBsRObcmSiuvCJsRW ntG6DUlksnpefXrvu4NGXzDs2VXuvvVc2jSPPrbu+fecSstOE/u3H0/06Sz5nRvo n6D5oB9v5I2BMtbZxBIVHF1KCfp52mE/TpqFxh19GJbkg1Jsdw4= =wojJ -----END PGP SIGNATURE-----
