Source: ruby-sanitize X-Debbugs-CC: t...@security.debian.org Severity: grave Tags: security
Hi, The following vulnerability was published for ruby-sanitize. CVE-2023-36823[0]: | Sanitize is an allowlist-based HTML and CSS sanitizer. Using | carefully crafted input, an attacker may be able to sneak arbitrary | HTML and CSS through Sanitize starting with version 3.0.0 and prior | to version 6.0.2 when Sanitize is configured to use the built-in | "relaxed" config or when using a custom config that allows `style` | elements and one or more CSS at-rules. This could result in cross- | site scripting or other undesired behavior when the malicious HTML | and CSS are rendered in a browser. Sanitize 6.0.2 performs | additional escaping of CSS in `style` element content, which fixes | this issue. Users who are unable to upgrade can prevent this issue | by using a Sanitize config that doesn't allow `style` elements, | using a Sanitize config that doesn't allow CSS at-rules, or by | manually escaping the character sequence `</` as `<\/` in `style` | element content. https://github.com/rgrove/sanitize/commit/76ed46e6dc70820f38efe27de8dabd54dddb5220 (v6.0.2) https://github.com/rgrove/sanitize/security/advisories/GHSA-f5ww-cq3m-q3g7 If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2023-36823 https://www.cve.org/CVERecord?id=CVE-2023-36823 Please adjust the affected versions in the BTS as needed.