Search for packages
| purl | pkg:deb/debian/ruby-loofah@2.2.3-1%2Bdeb10u1 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-19uf-4mfq-87dv
Aliases: CVE-2022-23516 GHSA-3x8r-x6xp-q4vm GMS-2022-8288 |
Uncontrolled Recursion in Loofah ## Summary Loofah `>= 2.2.0, < 2.19.1` uses recursion for sanitizing `CDATA` sections, making it susceptible to stack exhaustion and raising a `SystemStackError` exception. This may lead to a denial of service through CPU resource consumption. ## Mitigation Upgrade to Loofah `>= 2.19.1`. Users who are unable to upgrade may be able to mitigate this vulnerability by limiting the length of the strings that are sanitized. |
Affected by 0 other vulnerabilities. |
|
VCID-8ut1-66x1-4kfx
Aliases: CVE-2022-23514 GHSA-486f-hjj9-9vhh GMS-2022-8289 |
Inefficient Regular Expression Complexity in Loofah ## Summary Loofah `< 2.19.1` contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to sanitize certain SVG attributes. This may lead to a denial of service through CPU resource consumption. ## Mitigation Upgrade to Loofah `>= 2.19.1`. |
Affected by 0 other vulnerabilities. |
|
VCID-9eux-3fc7-13gr
Aliases: CVE-2019-15587 GHSA-c3gv-9cxf-6f57 |
Loofah XSS Vulnerability In the Loofah gem, through v2.3.0, unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished. |
Affected by 3 other vulnerabilities. |
|
VCID-ef83-dy1p-g7fp
Aliases: CVE-2022-23515 GHSA-228g-948r-83gx GMS-2022-8287 |
Improper neutralization of data URIs may allow XSS in Loofah ## Summary Loofah `>= 2.1.0, < 2.19.1` is vulnerable to cross-site scripting via the `image/svg+xml` media type in data URIs. ## Mitigation Upgrade to Loofah `>= 2.19.1`. |
Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-9eux-3fc7-13gr | Loofah XSS Vulnerability In the Loofah gem, through v2.3.0, unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished. |
CVE-2019-15587
GHSA-c3gv-9cxf-6f57 |
| VCID-embn-3gvw-b7bp | Loofah XSS Vulnerability In the Loofah gem, through v2.2.2, unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished. |
CVE-2018-16468
GHSA-g4xq-jx4w-4cjv |
| VCID-nt8x-sgpg-ffh3 | Revert libxml2 behavior in Nokogiri gem that could cause XSS [MRI] Behavior in libxml2 has been reverted which caused CVE-2018-8048 (loofah gem), CVE-2018-3740 (sanitize gem), and CVE-2018-3741 (rails-html-sanitizer gem). The commit in question is here: https://github.com/GNOME/libxml2/commit/960f0e2 and more information is available about this commit and its impact here: https://github.com/flavorjones/loofah/issues/144 This release simply reverts the libxml2 commit in question to protect users of Nokogiri's vendored libraries from similar vulnerabilities. If you're offended by what happened here, I'd kindly ask that you comment on the upstream bug report here: https://bugzilla.gnome.org/show_bug.cgi?id=769760 |
CVE-2018-8048
GHSA-x7rv-cr6v-4vm4 |