The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah >= 2.2.0, < 2.19.1 uses recursion for sanitizing CDATA sections, making it susceptible to stack exhaustion and raising a SystemStackError exception. This may lead to a denial of service through CPU resource consumption. This issue is patched in version 2.19.1. Users who are unable to upgrade may be able to mitigate this vulnerability by limiting the length of the strings that are sanitized.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade satellite-maintainUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-unicodeUpgrade rubygem-unfUpgrade rubygem-unf_ext-debugsourceUpgrade satellite-cliUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-unicode-display_widthUpgrade rubygem-foreman_maintainUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-highlineUpgrade rubygem-mime-typesUpgrade rubygem-little-pluggerUpgrade rubygem-mime-types-dataUpgrade rubygem-oauth-ttyUpgrade rubygem-ffiUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-netrcUpgrade foreman-cliUpgrade rubygem-hashieUpgrade satellite-cloneUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-oauthUpgrade rubygem-localeUpgrade rubygem-loggingUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-unf_extUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-unicode-debuginfoUpgrade rubygem-snaky_hashUpgrade python39-pulp_manifestUpgrade rubygem-multi_jsonUpgrade rubygem-rest-clientUpgrade rubygem-gssapiUpgrade rubygem-clampUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-fast_gettextUpgrade rubygem-apipie-bindingsUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-http-acceptUpgrade rubygem-ffi-debugsourceUpgrade rubygem-ffi-debuginfoUpgrade rubygem-powerbarUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hammer_cliUpgrade rubygem-domain_nameUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-version_gemUpgrade rubygem-unicode-debugsourceUpgrade rubygem-amazing_printUpgrade rubygem-http-cookie | May 4, 2023 | Dec 14, 2022 |
| Debian | — | Upgrade ruby-loofah | Sep 15, 2023 | Dec 14, 2022 |
| Redhat_linux | — | Upgrade rubygem-mime-types-dataUpgrade rubygem-unfUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-multi_jsonUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-netrcUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-rest-clientUpgrade rubygem-clampUpgrade satellite-maintainUpgrade rubygem-little-pluggerUpgrade satellite-cloneUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-snaky_hashUpgrade rubygem-ffi-debugsourceUpgrade rubygem-jwtUpgrade rubygem-unicodeUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-unicode-debugsourceUpgrade rubygem-unicode-display_widthUpgrade rubygem-gssapiUpgrade rubygem-unicode-debuginfoUpgrade rubygem-oauth-ttyUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-foreman_maintainUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-localeUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-amazing_printUpgrade rubygem-domain_nameUpgrade rubygem-http-acceptUpgrade foreman-cliUpgrade rubygem-hammer_cliUpgrade python39-pulp_manifestUpgrade satellite-cliUpgrade rubygem-version_gemUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-ffi-debuginfoUpgrade rubygem-highlineUpgrade rubygem-oauthUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-fast_gettextUpgrade rubygem-hashieUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-loggingUpgrade rubygem-ffiUpgrade rubygem-http-cookieUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-powerbarUpgrade rubygem-apipie-bindingsUpgrade rubygem-unf_extUpgrade rubygem-hammer_cli_foreman_discovery | May 4, 2023 | Dec 14, 2022 |
| Rocky_linux | — | Upgrade libdb-cxxUpgrade libdb-sql-debuginfoUpgrade libdb-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-utils-debuginfoUpgrade libdb-debugsourceUpgrade libdb-cxx-debuginfo | Mar 12, 2024 | Dec 14, 2022 |
| Suse | — | Upgrade ruby2.5-rubygem-loofah-docUpgrade ruby2.5-rubygem-loofah-testsuiteUpgrade ruby2.5-rubygem-loofah | Mar 30, 2023 | Dec 14, 2022 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub