Cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in the Dialog widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title option.

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-9d655503ea advisory.

  - Cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in the Dialog widget in jQuery UI before     1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title option.
    (CVE-2010-5312)

  - Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject     arbitrary web script or HTML via the closeText parameter of the dialog function. (CVE-2016-7103)

  - jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of     the `altField` option of the Datepicker widget from untrusted sources may execute untrusted code. The     issue is fixed in jQuery UI 1.13.0. Any string value passed to the `altField` option is now treated as a     CSS selector. A workaround is to not accept the value of the `altField` option from untrusted sources.
    (CVE-2021-41182)

  - jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of     various `*Text` options of the Datepicker widget from untrusted sources may execute untrusted code. The     issue is fixed in jQuery UI 1.13.0. The values passed to various `*Text` options are now always treated as     pure text, not HTML. A workaround is to not accept the value of the `*Text` options from untrusted     sources. (CVE-2021-41183)

  - jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of     the `of` option of the `.position()` util from untrusted sources may execute untrusted code. The issue is     fixed in jQuery UI 1.13.0. Any string value passed to the `of` option is now treated as a CSS selector. A     workaround is to not accept the value of the `of` option from untrusted sources. (CVE-2021-41184)

  - Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be     vulnerable to improper input validation. This could allow an attacker to inject disallowed values or     overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter critical or     sensitive data. (CVE-2022-25271)

  - In some situations, the Image module does not correctly check access to image files not stored in the     standard public files directory when generating derivative images using the image styles system. Access to     a non-public file is checked only if it is stored in the private file system. However, some contributed     modules provide additional file systems, or schemes, which may lead to this vulnerability. This     vulnerability is mitigated by the fact that it only applies when the site sets (Drupal 9)     $config['image.settings']['allow_insecure_derivatives'] or (Drupal 7)     $conf['image_allow_insecure_derivatives'] to TRUE. The recommended and default setting is FALSE, and     Drupal core does not provide a way to change that in the admin UI. Some sites may require configuration     changes following this security release. Review the release notes for your Drupal version if you have     issues accessing files or image styles after updating. (CVE-2022-25275)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 35 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-bf18450366 advisory.

  - Cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in the Dialog widget in jQuery UI before     1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title option.
    (CVE-2010-5312)

  - Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject     arbitrary web script or HTML via the closeText parameter of the dialog function. (CVE-2016-7103)

  - jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of     the `altField` option of the Datepicker widget from untrusted sources may execute untrusted code. The     issue is fixed in jQuery UI 1.13.0. Any string value passed to the `altField` option is now treated as a     CSS selector. A workaround is to not accept the value of the `altField` option from untrusted sources.
    (CVE-2021-41182)

  - jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of     various `*Text` options of the Datepicker widget from untrusted sources may execute untrusted code. The     issue is fixed in jQuery UI 1.13.0. The values passed to various `*Text` options are now always treated as     pure text, not HTML. A workaround is to not accept the value of the `*Text` options from untrusted     sources. (CVE-2021-41183)

  - jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of     the `of` option of the `.position()` util from untrusted sources may execute untrusted code. The issue is     fixed in jQuery UI 1.13.0. Any string value passed to the `of` option is now treated as a CSS selector. A     workaround is to not accept the value of the `of` option from untrusted sources. (CVE-2021-41184)

  - Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be     vulnerable to improper input validation. This could allow an attacker to inject disallowed values or     overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter critical or     sensitive data. (CVE-2022-25271)

  - In some situations, the Image module does not correctly check access to image files not stored in the     standard public files directory when generating derivative images using the image styles system. Access to     a non-public file is checked only if it is stored in the private file system. However, some contributed     modules provide additional file systems, or schemes, which may lead to this vulnerability. This     vulnerability is mitigated by the fact that it only applies when the site sets (Drupal 9)     $config['image.settings']['allow_insecure_derivatives'] or (Drupal 7)     $conf['image_allow_insecure_derivatives'] to TRUE. The recommended and default setting is FALSE, and     Drupal core does not provide a way to change that in the admin UI. Some sites may require configuration     changes following this security release. Review the release notes for your Drupal version if you have     issues accessing files or image styles after updating. (CVE-2022-25275)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the instance of Drupal running on the remote web server is 7.x prior to 7.86, 9.2.x prior to 9.2.11, or 9.3.x prior to 9.3.3. It is, therefore, affected by multiple cross-site scripting vulnerabilities due to its usage of the third party component jQuery UI prior to 1.13.0.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the instance of Drupal running on the remote web server is 7.x prior to 7.86, 9.2.x prior to 9.2.11, or 9.3.x prior to 9.3.3. It is, therefore, affected by multiple vulnerabilities.

  - Cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in the Dialog widget in jQuery UI before     1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title option.
    (CVE-2010-5312)

  - Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject     arbitrary web script or HTML via the closeText parameter of the dialog function. (CVE-2016-7103)

  - jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of     the `altField` option of the Datepicker widget from untrusted sources may execute untrusted code. The     issue is fixed in jQuery UI 1.13.0. Any string value passed to the `altField` option is now treated as a     CSS selector. A workaround is to not accept the value of the `altField` option from untrusted sources.
    (CVE-2021-41182)

  - jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of     various `*Text` options of the Datepicker widget from untrusted sources may execute untrusted code. The     issue is fixed in jQuery UI 1.13.0. The values passed to various `*Text` options are now always treated as     pure text, not HTML. A workaround is to not accept the value of the `*Text` options from untrusted     sources. (CVE-2021-41183)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version number, jQuery UI is prior to 1.10.0. Therefore, it may be affected by multiple vulnerabilities :

 - Cross-Site Scripting (XSSS) due to improper escaping of the tooltip title attribute.

 - Cross-Site Scripting (XSS) due to improper escaping of the title option in jquery.ui.dialog.js.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Note: The IdM version provided by this update no longer uses jQuery.

Bug fixes :

  - The ipa-server-install, ipa-replica-install, and     ipa-client-install utilities are not supported on     machines running in FIPS-140 mode. Previously, IdM did     not warn users about this. Now, IdM does not allow     running the utilities in FIPS-140 mode, and displays an     explanatory message.

  - If an Active Directory (AD) server was specified or     discovered automatically when running the     ipa-client-install utility, the utility produced a     traceback instead of informing the user that an IdM     server is expected in this situation. Now,     ipa-client-install detects the AD server and fails with     an explanatory message.

  - When IdM servers were configured to require the TLS     protocol version 1.1 (TLSv1.1) or later in the httpd     server, the ipa utility failed. With this update,     running ipa works as expected with TLSv1.1 or later.

  - In certain high-load environments, the Kerberos     authentication step of the IdM client installer can     fail. Previously, the entire client installation failed     in this situation. This update modifies ipa-client-     install to prefer the TCP protocol over the UDP protocol     and to retry the authentication attempt in case of     failure.

  - If ipa-client-install updated or created the     /etc/nsswitch.conf file, the sudo utility could     terminate unexpectedly with a segmentation fault. Now,     ipa-client-install puts a new line character at the end     of nsswitch.conf if it modifies the last line of the     file, fixing this bug.

  - The ipa-client-automount utility failed with the     'UNWILLING_TO_PERFORM' LDAP error when the     nsslapd-minssf Red Hat Directory Server configuration     parameter was set to '1'. This update modifies     ipa-client-automount to use encrypted connection for     LDAP searches by default, and the utility now finishes     successfully even with nsslapd-minssf specified.

  - If installing an IdM server failed after the Certificate     Authority (CA) installation, the 'ipa-server-install
    --uninstall' command did not perform a proper cleanup.
    After the user issued 'ipa-server-install --uninstall'     and then attempted to install the server again, the     installation failed. Now, 'ipa-server-install
    --uninstall' removes the CA-related files in the     described situation, and ipa-server-install no longer     fails with the mentioned error message.

  - Running ipa-client-install added the 'sss' entry to the     sudoers line in nsswitch.conf even if 'sss' was already     configured and the entry was present in the file.
    Duplicate 'sss' then caused sudo to become unresponsive.
    Now, ipa-client-install no longer adds 'sss' if it is     already present in nsswitch.conf.

  - After running ipa-client-install, it was not possible to     log in using SSH under certain circumstances. Now,     ipa-client-install no longer corrupts the sshd_config     file, and the sshd service can start as expected, and     logging in using SSH works in the described situation.

  - An incorrect definition of the dc attribute in the     /usr/share/ipa/05rfc2247.ldif file caused bogus error     messages to be returned during migration. The attribute     has been fixed, but the bug persists if the     copy-schema-to-ca.py script was run on Scientific Linux     6.6 prior to running it on Scientific Linux 6.7. To work     around this problem, manually copy     /usr/share/ipa/schema/05rfc2247.ldif to /etc/dirsrv     /slapd-PKI-IPA/schema/ and restart IdM.

From Red Hat Security Advisory 2015:1462 :

Updated ipa packages that fix two security issues and several bugs are now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments.

Two cross-site scripting (XSS) flaws were found in jQuery, which impacted the Identity Management web administrative interface, and could allow an authenticated user to inject arbitrary HTML or web script into the interface. (CVE-2010-5312, CVE-2012-6662)

Note: The IdM version provided by this update no longer uses jQuery.

Bug fixes :

* The ipa-server-install, ipa-replica-install, and ipa-client-install utilities are not supported on machines running in FIPS-140 mode.
Previously, IdM did not warn users about this. Now, IdM does not allow running the utilities in FIPS-140 mode, and displays an explanatory message. (BZ#1131571)

* If an Active Directory (AD) server was specified or discovered automatically when running the ipa-client-install utility, the utility produced a traceback instead of informing the user that an IdM server is expected in this situation. Now, ipa-client-install detects the AD server and fails with an explanatory message. (BZ#1132261)

* When IdM servers were configured to require the TLS protocol version 1.1 (TLSv1.1) or later in the httpd server, the ipa utility failed.
With this update, running ipa works as expected with TLSv1.1 or later.
(BZ#1154687)

* In certain high-load environments, the Kerberos authentication step of the IdM client installer can fail. Previously, the entire client installation failed in this situation. This update modifies ipa-client-install to prefer the TCP protocol over the UDP protocol and to retry the authentication attempt in case of failure.
(BZ#1161722)

* If ipa-client-install updated or created the /etc/nsswitch.conf file, the sudo utility could terminate unexpectedly with a segmentation fault. Now, ipa-client-install puts a new line character at the end of nsswitch.conf if it modifies the last line of the file, fixing this bug. (BZ#1185207)

* The ipa-client-automount utility failed with the 'UNWILLING_TO_PERFORM' LDAP error when the nsslapd-minssf Red Hat Directory Server configuration parameter was set to '1'. This update modifies ipa-client-automount to use encrypted connection for LDAP searches by default, and the utility now finishes successfully even with nsslapd-minssf specified. (BZ#1191040)

* If installing an IdM server failed after the Certificate Authority (CA) installation, the 'ipa-server-install --uninstall' command did not perform a proper cleanup. After the user issued 'ipa-server-install --uninstall' and then attempted to install the server again, the installation failed. Now, 'ipa-server-install
--uninstall' removes the CA-related files in the described situation, and ipa-server-install no longer fails with the mentioned error message. (BZ#1198160)

* Running ipa-client-install added the 'sss' entry to the sudoers line in nsswitch.conf even if 'sss' was already configured and the entry was present in the file. Duplicate 'sss' then caused sudo to become unresponsive. Now, ipa-client-install no longer adds 'sss' if it is already present in nsswitch.conf. (BZ#1198339)

* After running ipa-client-install, it was not possible to log in using SSH under certain circumstances. Now, ipa-client-install no longer corrupts the sshd_config file, and the sshd service can start as expected, and logging in using SSH works in the described situation. (BZ#1201454)

* An incorrect definition of the dc attribute in the /usr/share/ipa/05rfc2247.ldif file caused bogus error messages to be returned during migration. The attribute has been fixed, but the bug persists if the copy-schema-to-ca.py script was run on Red Hat Enterprise Linux 6.6 prior to running it on Red Hat Enterprise Linux 6.7. To work around this problem, manually copy /usr/share/ipa/schema/05rfc2247.ldif to /etc/dirsrv/slapd-PKI-IPA/schema/ and restart IdM. (BZ#1220788)

All ipa users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

Updated ipa packages that fix two security issues and several bugs are now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments.

Two cross-site scripting (XSS) flaws were found in jQuery, which impacted the Identity Management web administrative interface, and could allow an authenticated user to inject arbitrary HTML or web script into the interface. (CVE-2010-5312, CVE-2012-6662)

Note: The IdM version provided by this update no longer uses jQuery.

Bug fixes :

* The ipa-server-install, ipa-replica-install, and ipa-client-install utilities are not supported on machines running in FIPS-140 mode.
Previously, IdM did not warn users about this. Now, IdM does not allow running the utilities in FIPS-140 mode, and displays an explanatory message. (BZ#1131571)

* If an Active Directory (AD) server was specified or discovered automatically when running the ipa-client-install utility, the utility produced a traceback instead of informing the user that an IdM server is expected in this situation. Now, ipa-client-install detects the AD server and fails with an explanatory message. (BZ#1132261)

* When IdM servers were configured to require the TLS protocol version 1.1 (TLSv1.1) or later in the httpd server, the ipa utility failed.
With this update, running ipa works as expected with TLSv1.1 or later.
(BZ#1154687)

* In certain high-load environments, the Kerberos authentication step of the IdM client installer can fail. Previously, the entire client installation failed in this situation. This update modifies ipa-client-install to prefer the TCP protocol over the UDP protocol and to retry the authentication attempt in case of failure.
(BZ#1161722)

* If ipa-client-install updated or created the /etc/nsswitch.conf file, the sudo utility could terminate unexpectedly with a segmentation fault. Now, ipa-client-install puts a new line character at the end of nsswitch.conf if it modifies the last line of the file, fixing this bug. (BZ#1185207)

* The ipa-client-automount utility failed with the 'UNWILLING_TO_PERFORM' LDAP error when the nsslapd-minssf Red Hat Directory Server configuration parameter was set to '1'. This update modifies ipa-client-automount to use encrypted connection for LDAP searches by default, and the utility now finishes successfully even with nsslapd-minssf specified. (BZ#1191040)

* If installing an IdM server failed after the Certificate Authority (CA) installation, the 'ipa-server-install --uninstall' command did not perform a proper cleanup. After the user issued 'ipa-server-install --uninstall' and then attempted to install the server again, the installation failed. Now, 'ipa-server-install
--uninstall' removes the CA-related files in the described situation, and ipa-server-install no longer fails with the mentioned error message. (BZ#1198160)

* Running ipa-client-install added the 'sss' entry to the sudoers line in nsswitch.conf even if 'sss' was already configured and the entry was present in the file. Duplicate 'sss' then caused sudo to become unresponsive. Now, ipa-client-install no longer adds 'sss' if it is already present in nsswitch.conf. (BZ#1198339)

* After running ipa-client-install, it was not possible to log in using SSH under certain circumstances. Now, ipa-client-install no longer corrupts the sshd_config file, and the sshd service can start as expected, and logging in using SSH works in the described situation. (BZ#1201454)

* An incorrect definition of the dc attribute in the /usr/share/ipa/05rfc2247.ldif file caused bogus error messages to be returned during migration. The attribute has been fixed, but the bug persists if the copy-schema-to-ca.py script was run on Red Hat Enterprise Linux 6.6 prior to running it on Red Hat Enterprise Linux 6.7. To work around this problem, manually copy /usr/share/ipa/schema/05rfc2247.ldif to /etc/dirsrv/slapd-PKI-IPA/schema/ and restart IdM. (BZ#1220788)

All ipa users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

Shadowman131 discovered that jqueryui, a JavaScript UI library for dynamic web applications, failed to properly sanitize its 'title' option. This would allow a remote attacker to inject arbitrary code through cross-site scripting.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Shadowman131 discovered that jqueryui, a JavaScript UI library for dynamic web applications, failed to properly sanitize its 'title'option. This would allow a remote attacker to inject arbitrary code through cross-site scripting.

Two cross-site scripting (XSS) flaws were found in jQuery, which impacted the Identity Management web administrative interface, and could allow an authenticated user to inject arbitrary HTML or web script into the interface. (CVE-2010-5312, CVE-2012-6662)

Note: The IdM version provided by this update no longer uses jQuery.

  - Added the 'ipa-cacert-manage' command, which renews the     Certification Authority (CA) file.

  - Added the ID Views feature.

  - IdM now supports using one-time password (OTP)     authentication and allows gradual migration from     proprietary OTP solutions to the IdM OTP solution.

  - Added the 'ipa-backup' and 'ipa-restore' commands to     allow manual backups.

  - Added a solution for regulating access permissions to     specific sections of the IdM server.

This update also fixes several bugs, including :

  - Previously, when IdM servers were configured to require     the Transport Layer Security protocol version 1.1     (TLSv1.1) or later in the httpd server, the 'ipa'     command-line utility failed. With this update, running     'ipa' works as expected with TLSv1.1 or later.

In addition, this update adds multiple enhancements, including :

  - The 'ipa-getkeytab' utility can now optionally fetch     existing keytabs from the KDC. Previously, retrieving an     existing keytab was not supported, as the only option     was to generate a new key.

  - You can now create and manage a '.' root zone on IdM     servers. DNS queries sent to the IdM DNS server use this     configured zone instead of the public zone.

  - The IdM server web UI has been updated and is now based     on the Patternfly framework, offering better     responsiveness.

  - A new user attribute now enables provisioning systems to     add custom tags for user objects. The tags can be used     for automember rules or for additional local     interpretation.

  - This update adds a new DNS zone type to ensure that     forward and master zones are better separated. As a     result, the IdM DNS interface complies with the forward     zone semantics in BIND.

  - This update adds a set of Apache modules that external     applications can use to achieve tighter interaction with     IdM beyond simple authentication.

  - IdM supports configuring automember rules for automated     assignment of users or hosts in respective groups     according to their characteristics, such as the     'userClass' or 'departmentNumber' attributes.
    Previously, the rules could be applied only to new     entries. This update allows applying the rules also to     existing users or hosts.

  - The extdom plug-in translates Security Identifiers     (SIDs) of Active Directory (AD) users and groups to     names and POSIX IDs. With this update, extdom returns     the full member list for groups and the full list of     group memberships for a user, the GECOS field, the home     directory, as well as the login shell of a user. Also,     an optional list of key-value pairs contains the SID of     the requested object if the SID is available.

Updated ipa packages that fix two security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments.

Two cross-site scripting (XSS) flaws were found in jQuery, which impacted the Identity Management web administrative interface, and could allow an authenticated user to inject arbitrary HTML or web script into the interface. (CVE-2010-5312, CVE-2012-6662)

Note: The IdM version provided by this update no longer uses jQuery.

This update adds several enhancements that are described in more detail in the Red Hat Enterprise Linux 7.1 Release Notes, linked to in the References section, including :

* Added the 'ipa-cacert-manage' command, which renews the Certification Authority (CA) file. (BZ#886645)

* Added the ID Views feature. (BZ#891984)

* IdM now supports using one-time password (OTP) authentication and allows gradual migration from proprietary OTP solutions to the IdM OTP solution. (BZ#919228)

* Added the 'ipa-backup' and 'ipa-restore' commands to allow manual backups. (BZ#951581)

* Added a solution for regulating access permissions to specific sections of the IdM server. (BZ#976382)

This update also fixes several bugs, including :

* Previously, when IdM servers were configured to require the Transport Layer Security protocol version 1.1 (TLSv1.1) or later in the httpd server, the 'ipa' command-line utility failed. With this update, running 'ipa' works as expected with TLSv1.1 or later.
(BZ#1156466)

In addition, this update adds multiple enhancements, including :

* The 'ipa-getkeytab' utility can now optionally fetch existing keytabs from the KDC. Previously, retrieving an existing keytab was not supported, as the only option was to generate a new key.
(BZ#1007367)

* You can now create and manage a '.' root zone on IdM servers. DNS queries sent to the IdM DNS server use this configured zone instead of the public zone. (BZ#1056202)

* The IdM server web UI has been updated and is now based on the Patternfly framework, offering better responsiveness. (BZ#1108212)

* A new user attribute now enables provisioning systems to add custom tags for user objects. The tags can be used for automember rules or for additional local interpretation. (BZ#1108229)

* This update adds a new DNS zone type to ensure that forward and master zones are better separated. As a result, the IdM DNS interface complies with the forward zone semantics in BIND. (BZ#1114013)

* This update adds a set of Apache modules that external applications can use to achieve tighter interaction with IdM beyond simple authentication. (BZ# 1107555)

* IdM supports configuring automember rules for automated assignment of users or hosts in respective groups according to their characteristics, such as the 'userClass' or 'departmentNumber' attributes. Previously, the rules could be applied only to new entries. This update allows applying the rules also to existing users or hosts. (BZ#1108226)

* The extdom plug-in translates Security Identifiers (SIDs) of Active Directory (AD) users and groups to names and POSIX IDs. With this update, extdom returns the full member list for groups and the full list of group memberships for a user, the GECOS field, the home directory, as well as the login shell of a user. Also, an optional list of key-value pairs contains the SID of the requested object if the SID is available. (BZ#1030699)

All ipa users are advised to upgrade to these updated packages, which contain backported patches to correct these issues and add these enhancements.

From Red Hat Security Advisory 2015:0442 :

Updated ipa packages that fix two security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments.

Two cross-site scripting (XSS) flaws were found in jQuery, which impacted the Identity Management web administrative interface, and could allow an authenticated user to inject arbitrary HTML or web script into the interface. (CVE-2010-5312, CVE-2012-6662)

Note: The IdM version provided by this update no longer uses jQuery.

This update adds several enhancements that are described in more detail in the Red Hat Enterprise Linux 7.1 Release Notes, linked to in the References section, including :

* Added the 'ipa-cacert-manage' command, which renews the Certification Authority (CA) file. (BZ#886645)

* Added the ID Views feature. (BZ#891984)

* IdM now supports using one-time password (OTP) authentication and allows gradual migration from proprietary OTP solutions to the IdM OTP solution. (BZ#919228)

* Added the 'ipa-backup' and 'ipa-restore' commands to allow manual backups. (BZ#951581)

* Added a solution for regulating access permissions to specific sections of the IdM server. (BZ#976382)

This update also fixes several bugs, including :

* Previously, when IdM servers were configured to require the Transport Layer Security protocol version 1.1 (TLSv1.1) or later in the httpd server, the 'ipa' command-line utility failed. With this update, running 'ipa' works as expected with TLSv1.1 or later.
(BZ#1156466)

In addition, this update adds multiple enhancements, including :

* The 'ipa-getkeytab' utility can now optionally fetch existing keytabs from the KDC. Previously, retrieving an existing keytab was not supported, as the only option was to generate a new key.
(BZ#1007367)

* You can now create and manage a '.' root zone on IdM servers. DNS queries sent to the IdM DNS server use this configured zone instead of the public zone. (BZ#1056202)

* The IdM server web UI has been updated and is now based on the Patternfly framework, offering better responsiveness. (BZ#1108212)

* A new user attribute now enables provisioning systems to add custom tags for user objects. The tags can be used for automember rules or for additional local interpretation. (BZ#1108229)

* This update adds a new DNS zone type to ensure that forward and master zones are better separated. As a result, the IdM DNS interface complies with the forward zone semantics in BIND. (BZ#1114013)

* This update adds a set of Apache modules that external applications can use to achieve tighter interaction with IdM beyond simple authentication. (BZ# 1107555)

* IdM supports configuring automember rules for automated assignment of users or hosts in respective groups according to their characteristics, such as the 'userClass' or 'departmentNumber' attributes. Previously, the rules could be applied only to new entries. This update allows applying the rules also to existing users or hosts. (BZ#1108226)

* The extdom plug-in translates Security Identifiers (SIDs) of Active Directory (AD) users and groups to names and POSIX IDs. With this update, extdom returns the full member list for groups and the full list of group memberships for a user, the GECOS field, the home directory, as well as the login shell of a user. Also, an optional list of key-value pairs contains the SID of the requested object if the SID is available. (BZ#1030699)

All ipa users are advised to upgrade to these updated packages, which contain backported patches to correct these issues and add these enhancements.

- Fix CVE-2010-5312 couchdb: jquery-ui: XSS vulnerability     in jQuery.ui.dialog title option (rhbz #1166767)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
169174	Fedora 36 : drupal7 (2022-9d655503ea)	Nessus	Fedora Local Security Checks	high
169112	Fedora 35 : drupal7 (2022-bf18450366)	Nessus	Fedora Local Security Checks	high
113122	Drupal 7.x < 7.86 Cross-Site Scripting	Web App Scanning	Component Vulnerability	medium
113121	Drupal 9.2.x < 9.2.11 Cross-Site Scripting	Web App Scanning	Component Vulnerability	medium
113120	Drupal 9.3.x < 9.3.3 Cross-Site Scripting	Web App Scanning	Component Vulnerability	medium
156863	Drupal 7.x < 7.86 / 9.2.x < 9.2.11 / 9.3.x < 9.3.3 Multiple Vulnerabilities (drupal-2022-01-19)	Nessus	CGI abuses	medium
98394	jQuery UI < 1.10.0 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	medium
85197	Scientific Linux Security Update : ipa on SL6.x i386/x86_64 (20150722)	Nessus	Scientific Linux Local Security Checks	medium
85113	Oracle Linux 6 : ipa (ELSA-2015-1462)	Nessus	Oracle Linux Local Security Checks	medium
85027	CentOS 6 : ipa (CESA-2015:1462)	Nessus	CentOS Local Security Checks	medium
84953	RHEL 6 : ipa (RHSA-2015:1462)	Nessus	Red Hat Local Security Checks	medium
84447	Debian DLA-258-1 : jqueryui security update	Nessus	Debian Local Security Checks	medium
83235	Debian DSA-3249-1 : jqueryui - security update	Nessus	Debian Local Security Checks	medium
82253	Scientific Linux Security Update : ipa on SL7.x x86_64 (20150305)	Nessus	Scientific Linux Local Security Checks	medium
81897	CentOS 7 : ipa (CESA-2015:0442)	Nessus	CentOS Local Security Checks	medium
81806	Oracle Linux 7 : ipa (ELSA-2015-0442)	Nessus	Oracle Linux Local Security Checks	medium
81638	RHEL 7 : ipa (RHSA-2015:0442)	Nessus	Red Hat Local Security Checks	medium
79909	Fedora 20 : couchdb-1.6.1-4.fc20 (2014-16048)	Nessus	Fedora Local Security Checks	medium
79903	Fedora 21 : couchdb-1.6.1-4.fc21 (2014-15967)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2010-5312

medium

Tenable Plugins

high

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium