Stay Secure with the Latest Linux Advisories

security advisorycross-site scriptingmedium severity

Arch Linux: ASA-202101-8 mdbook Cross-Site Scripting Medium Severity

The package mdbook before version 0.4.5-1 is vulnerable to cross-site scripting. . Arch Linux Security Advisory ASA-202101-8 ======================================== Severity: Medium Date : 2021-01-12 CVE-ID : CVE-2020-26297 Package : mdbook Type : cross-site scripting Remote : Yes Link : https://security.archlinux.org/AVG-1399 Summary ====== The package mdbook before version 0.4.5-1 is vulnerable to cross-site scripting. Resolution ========= Upgrade to 0.4.5-1. # pacman -Syu "mdbook> =0.4.5-1" The problem has been fixed upstream in version 0.4.5. Workaround ========= None. Description ========== The search feature of mdBook (introduced in version 0.1.4) was affected by a cross site scripting vulnerability that allowed an attacker to execute arbitrary JavaScript code on an user's browser by tricking the user into typing a malicious search query, or tricking the user into clicking a link to the search page with the malicious search query prefilled. mdBook 0.4.5 fixes the vulnerability by properly escaping the search query. Impact ===== A malicious user can execute arbitrary code in a user's browser with a malicious search query. References ========= https://groups.google.com/g/rustlang-security-announcements/c/3-sO6of29O0 https://github.com/rust-lang/mdBook/commit/648c9ae772bec83f0a5954d17b4287d5bb1d6606 https://security.archlinux.org/CVE-2020-26297 . Arch Linux Security Bulletin ASA-202110-5: Moderate risk reflected XSS vulnerability in mdbook resolved in release 0.4.6-2.. Arch Linux, mdbook security, cross-site scripting, security updates, advisory. . Severity: Medium. LinuxSecurity.com Team

Jan 15, 2021 •Medium ArchLinux