[IT-SecNots] [SECURITY] [DSA 4171-1] ruby-loofah security update

[Salvatore Bonaccorso <carnil AT debian.org>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-4171-1                   security AT debian.org
https://www.debian.org/security/                     Salvatore Bonaccorso
April 13, 2018                        https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : ruby-loofah
CVE ID         : CVE-2018-8048
Debian Bug     : 893596

The Shopify Application Security Team reported that ruby-loofah, a
general library for manipulating and transforming HTML/XML documents and
fragments, allows non-whitelisted attributes to be present in sanitized
output when input with specially-crafted HTML fragments. This might
allow to mount a code injection attack into a browser consuming
sanitized output.

For the stable distribution (stretch), this problem has been fixed in
version 2.0.3-2+deb9u1.

We recommend that you upgrade your ruby-loofah packages.

For the detailed security status of ruby-loofah please refer to its
security tracker page at:
https://security-tracker.debian.org/tracker/ruby-loofah

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce AT lists.debian.org
-----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAlrRAO5fFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND
z0SyAQ/6AuoBIQB14OW/4cibdZW6OtsRkM+5yO3zjWrQi0zdU0GpYh+SKlBhLzPp
KcaWn6Ux7MUaVF54Yf8EfgbZnNDFWyBAfXjOvOfqnQ35NIis3segNmJFeTfVXf3S
tHISfEGifesFPUD1Pp/60pEXR9OjHjVOIZvV0/GphiibAWYMjjRNll30wcOn1sJL
rSSuMXcku3L4luZ86Ur3Pye9Q5d9L3HeVHAGtOFYqtAlWNpmLHeyGPBVqsm899vL
cDaH7bv98LUTghEpXDErJag6l8D2zpmIGwbhicmZ9v6byWD4n8yDn2Ma1x0lxQnT
au2VESuraruiwrXizREcCZST0IOgxI3K+XwiZsL/7z5h5PnhxGMiI1pWI34iliej
7ebXchW+si5we23GYXtvYxCNLqGbyX8fSaPWPl2dXDRwAh6dKa3KE0n7L8nTOabA
epWeejp8izJyiBo+AHUuxIz5ApLyHg70+TPDTu82oqohBaSLOpetqagO0kz8eOl7
bqOI6Gcgr9JAD1IkrSniktooj74ZMgXyEF6pjqsrV4GAh2vDlmkAjInxn+FsKcF5
fStbB1pytTXCSQRoJl72RqJ9vsWbtA7iMGu2QLu3KaOCFIn9BT4KSGI55GYh8u/u
vFqV39VbxF2K5SCqlutP2cHrOybfZnnkGoH/8zKYteWFc4SvhjU=
=aTX5
-----END PGP SIGNATURE-----