Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah >= 2.1.0, < 2.19.1 is vulnerable to cross-site scripting via the image/svg+xml media type in data URIs. This issue is patched in version 2.19.1.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade rubygem-jwtUpgrade rubygem-mime-types-dataUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-unicodeUpgrade rubygem-unicode-debugsourceUpgrade rubygem-netrcUpgrade satellite-maintainUpgrade rubygem-multi_jsonUpgrade rubygem-snaky_hashUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-oauthUpgrade rubygem-foreman_maintainUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-little-pluggerUpgrade rubygem-hammer_cli_foreman_openscapUpgrade satellite-cloneUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-oauth-ttyUpgrade rubygem-unicode-display_widthUpgrade rubygem-unfUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-apipie-bindingsUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-unicode-debuginfoUpgrade rubygem-rest-clientUpgrade rubygem-unf_extUpgrade foreman-cliUpgrade rubygem-powerbarUpgrade rubygem-gssapiUpgrade rubygem-domain_nameUpgrade rubygem-http-acceptUpgrade rubygem-highlineUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-localeUpgrade rubygem-ffiUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade python39-pulp_manifestUpgrade rubygem-hashieUpgrade rubygem-version_gemUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-clampUpgrade rubygem-amazing_printUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-ffi-debuginfoUpgrade satellite-cliUpgrade rubygem-loggingUpgrade rubygem-fast_gettextUpgrade rubygem-http-cookieUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cliUpgrade rubygem-ffi-debugsource | May 4, 2023 | Dec 14, 2022 |
| Debian | — | Upgrade ruby-loofah | Sep 15, 2023 | Dec 14, 2022 |
| Redhat_linux | — | Upgrade satellite-cloneUpgrade rubygem-powerbarUpgrade rubygem-clampUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-foreman_maintainUpgrade rubygem-apipie-bindingsUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-ffiUpgrade rubygem-hashieUpgrade rubygem-rest-clientUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-little-pluggerUpgrade foreman-cliUpgrade satellite-maintainUpgrade rubygem-oauth-ttyUpgrade rubygem-unfUpgrade rubygem-mime-types-dataUpgrade rubygem-highlineUpgrade rubygem-netrcUpgrade satellite-cliUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-oauthUpgrade rubygem-unicode-display_widthUpgrade rubygem-http-acceptUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-multi_jsonUpgrade rubygem-hammer_cliUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-version_gemUpgrade rubygem-ffi-debugsourceUpgrade rubygem-unicode-debuginfoUpgrade rubygem-unf_extUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-http-cookieUpgrade rubygem-loggingUpgrade python39-pulp_manifestUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-gssapiUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-amazing_printUpgrade rubygem-domain_nameUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-localeUpgrade rubygem-jwtUpgrade rubygem-unicodeUpgrade rubygem-fast_gettextUpgrade rubygem-snaky_hashUpgrade rubygem-unicode-debugsourceUpgrade rubygem-ffi-debuginfoUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_webhooks | May 4, 2023 | Dec 14, 2022 |
| Rocky_linux | — | Upgrade libdb-cxxUpgrade libdb-sql-debuginfoUpgrade libdb-cxx-debuginfoUpgrade libdb-debugsourceUpgrade libdb-utils-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-debuginfo | Mar 12, 2024 | Dec 14, 2022 |
| Suse | — | Upgrade ruby2.5-rubygem-loofahUpgrade ruby2.5-rubygem-loofah-testsuiteUpgrade ruby2.5-rubygem-loofah-doc | Mar 30, 2023 | Dec 14, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub