The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Prior to version 1.4.4, a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags in either of the following ways: allow both "math" and "style" elements, or allow both "svg" and "style" elements. Code is only impacted if allowed tags are being overridden. . This issue is fixed in version 1.4.4. All users overriding the allowed tags to include "math" or "svg" and "style" should either upgrade or use the following workaround immediately: Remove "style" from the overridden allowed tags, or remove "math" and "svg" from the overridden allowed tags.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade satellite-maintainUpgrade rubygem-powerbarUpgrade rubygem-http-acceptUpgrade rubygem-multi_jsonUpgrade rubygem-snaky_hashUpgrade satellite-cliUpgrade rubygem-unicode-debugsourceUpgrade rubygem-unf_extUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-netrcUpgrade rubygem-fast_gettextUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-mime-typesUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-http-cookieUpgrade rubygem-gssapiUpgrade rubygem-localeUpgrade rubygem-ffi-debugsourceUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-loggingUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-ffiUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-version_gemUpgrade python39-pulp_manifestUpgrade rubygem-clampUpgrade rubygem-ffi-debuginfoUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-oauthUpgrade rubygem-unicode-display_widthUpgrade rubygem-highlineUpgrade rubygem-domain_nameUpgrade rubygem-amazing_printUpgrade rubygem-hammer_cliUpgrade rubygem-apipie-bindingsUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-hashieUpgrade rubygem-mime-types-dataUpgrade rubygem-rest-clientUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-foreman_maintainUpgrade rubygem-unicode-debuginfoUpgrade rubygem-unfUpgrade rubygem-unicodeUpgrade satellite-cloneUpgrade rubygem-oauth-ttyUpgrade rubygem-hammer_cli_foreman_googleUpgrade foreman-cliUpgrade rubygem-little-pluggerUpgrade rubygem-hammer_cli_foreman_admin | May 4, 2023 | Dec 14, 2022 |
| Debian | — | Upgrade ruby-rails-html-sanitizer | Sep 15, 2023 | Dec 14, 2022 |
| Redhat_linux | — | Upgrade rubygem-ffi-debuginfoUpgrade rubygem-hammer_cli_katelloUpgrade foreman-cliUpgrade rubygem-hashieUpgrade rubygem-localeUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-snaky_hashUpgrade rubygem-amazing_printUpgrade rubygem-mime-types-dataUpgrade rubygem-rest-clientUpgrade python39-pulp_manifestUpgrade rubygem-unf_extUpgrade rubygem-fast_gettextUpgrade rubygem-oauthUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-loggingUpgrade rubygem-unf_ext-debuginfoUpgrade satellite-cloneUpgrade rubygem-hammer_cliUpgrade rubygem-jwtUpgrade rubygem-apipie-bindingsUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-foreman_maintainUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-ffi-debugsourceUpgrade rubygem-domain_nameUpgrade rubygem-http-cookieUpgrade rubygem-unicodeUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-gssapiUpgrade rubygem-powerbarUpgrade rubygem-unfUpgrade rubygem-oauth-ttyUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-unicode-debugsourceUpgrade satellite-maintainUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-highlineUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-unicode-display_widthUpgrade rubygem-netrcUpgrade rubygem-version_gemUpgrade rubygem-clampUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-unicode-debuginfoUpgrade rubygem-little-pluggerUpgrade rubygem-ffiUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-mime-typesUpgrade satellite-cliUpgrade rubygem-multi_jsonUpgrade rubygem-http-accept | May 4, 2023 | Dec 14, 2022 |
| Rocky_linux | — | Upgrade libdb-cxxUpgrade libdb-sql-devel-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-debuginfoUpgrade libdb-cxx-debuginfoUpgrade libdb-utils-debuginfoUpgrade libdb-debugsource | Mar 12, 2024 | Dec 14, 2022 |
| Ruby_on_rails | — | Upgrade to the latest version of Ruby on Rails | Feb 7, 2024 | Dec 14, 2022 |
| Suse | — | Upgrade ruby2.5-rubygem-rails-html-sanitizer-docUpgrade ruby2.5-rubygem-rails-html-sanitizer-testsuiteUpgrade ruby2.5-rubygem-rails-html-sanitizer | Sep 21, 2023 | Dec 14, 2022 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub