Debian 10: DLA-3565-1 Critical: Ruby-Loofah XSS and DoS
debian lts
September 13, 2023
Multiple vulnerabilities were discovered in Loofah, a Ruby library for HTML/XML transformation and sanitization
Topics Covered
Summary
CVE-2022-23514
Inefficient regular expression that is susceptible to excessive
backtracking when attempting to sanitize certain SVG
attributes. This may lead to a denial of service through CPU
resource consumption.
CVE-2022-23515
Cross-site scripting via the image/svg+xml media type in data
URIs.
CVE-2022-23516
Loofah uses recursion for sanitizing CDATA sections, making it
susceptible to stack exhaustion and raising a SystemStackError
exception. This may lead to a denial of service through CPU
resource consumption.
For Debian 10 buster, these problems have been fixed in version
2.2.3-1+deb10u2.
We recommend that you upgrade your ruby-loofah packages.
For the detailed security status of ruby-loofah please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/source-package/ruby-loofah
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
PREVIOUS
NEXT
Severity
critical
Lowest
Low
Medium
High
Critical
Package: ruby-loofah
Version: 2.2.3-1+deb10u2
CVE ID: CVE-2022-23514 CVE-2022-23515 CVE-2022-23516
Debian Bug: 1026083
Topics Covered
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Related News
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!