rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Prior to version 1.4.4, a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags in either of the following ways: allow both "math" and "style" elements, or allow both "svg" and "style" elements. Code is only impacted if allowed tags are being overridden. . This issue is fixed in version 1.4.4. All users overriding the allowed tags to include "math" or "svg" and "style" should either upgrade or use the following workaround immediately: Remove "style" from the overridden allowed tags, or remove "math" and "svg" from the overridden allowed tags.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade rubygem-domain_nameUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-amazing_printUpgrade rubygem-hashieUpgrade rubygem-little-pluggerUpgrade rubygem-hammer_cliUpgrade rubygem-highlineUpgrade rubygem-oauthUpgrade rubygem-unicode-display_widthUpgrade rubygem-apipie-bindingsUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-unfUpgrade foreman-cliUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-unicode-debuginfoUpgrade rubygem-foreman_maintainUpgrade rubygem-unicodeUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-oauth-ttyUpgrade satellite-cloneUpgrade rubygem-mime-types-dataUpgrade rubygem-rest-clientUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-fast_gettextUpgrade rubygem-ffi-debugsourceUpgrade rubygem-ffi-debuginfoUpgrade rubygem-unf_extUpgrade satellite-cliUpgrade rubygem-http-cookieUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-clampUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-localeUpgrade rubygem-multi_jsonUpgrade rubygem-powerbarUpgrade rubygem-unicode-debugsourceUpgrade rubygem-loggingUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade python39-pulp_manifestUpgrade rubygem-gssapiUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-version_gemUpgrade rubygem-http-acceptUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-ffiUpgrade satellite-maintainUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-snaky_hashUpgrade rubygem-netrc | May 4, 2023 | Dec 14, 2022 |
| Debian | — | Upgrade ruby-rails-html-sanitizer | Sep 15, 2023 | Dec 14, 2022 |
| Redhat_linux | — | Upgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-loggingUpgrade python39-pulp_manifestUpgrade rubygem-oauthUpgrade foreman-cliUpgrade rubygem-gssapiUpgrade rubygem-rest-clientUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-oauth-ttyUpgrade rubygem-domain_nameUpgrade rubygem-hammer_cliUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-ffi-debuginfoUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hashieUpgrade rubygem-ffi-debugsourceUpgrade rubygem-fast_gettextUpgrade rubygem-unicodeUpgrade rubygem-mime-types-dataUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-foreman_maintainUpgrade rubygem-powerbarUpgrade rubygem-amazing_printUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-unfUpgrade rubygem-jwtUpgrade rubygem-snaky_hashUpgrade satellite-cloneUpgrade rubygem-localeUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-unf_extUpgrade rubygem-apipie-bindingsUpgrade rubygem-http-cookieUpgrade rubygem-version_gemUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-multi_jsonUpgrade satellite-cliUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-ffiUpgrade rubygem-mime-typesUpgrade rubygem-little-pluggerUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-unicode-debuginfoUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade satellite-maintainUpgrade rubygem-unicode-display_widthUpgrade rubygem-highlineUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-unicode-debugsourceUpgrade rubygem-netrcUpgrade rubygem-http-acceptUpgrade rubygem-clampUpgrade rubygem-unf_ext-debugsource | May 4, 2023 | Dec 14, 2022 |
| Rocky_linux | — | Upgrade libdb-debugsourceUpgrade libdb-debuginfoUpgrade libdb-utils-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-cxx-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-cxx | Mar 12, 2024 | Dec 14, 2022 |
| Ruby_on_rails | — | Upgrade to the latest version of Ruby on Rails | Feb 7, 2024 | Dec 14, 2022 |
| Suse | — | Upgrade ruby2.5-rubygem-rails-html-sanitizerUpgrade ruby2.5-rubygem-rails-html-sanitizer-testsuiteUpgrade ruby2.5-rubygem-rails-html-sanitizer-doc | Sep 21, 2023 | Dec 14, 2022 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub