[oss-security] 20180319 [CVE-2018-8048] Loofah XSS Vulnerability

https://github.com/flavorjones/loofah/issues/144

https://security.netapp.com/advisory/ntap-20191122-0003/

DSA-4171

The Shopify Application Security Team reported that ruby-loofah, a general library for manipulating and transforming HTML/XML documents and fragments, allows non-whitelisted attributes to be present in sanitized output when input with specially crafted HTML fragments.
This might allow to mount a code injection attack into a browser consuming sanitized output.

GitHub issue :

This issue has been created for public disclosure of an XSS / code injection vulnerability that was responsibly reported by the Shopify Application Security Team.

Loofah allows non-whitelisted attributes to be present in sanitized output when input with specially crafted HTML fragments.

ID	Name	Product	Family	Severity
109046	Debian DSA-4171-1 : ruby-loofah - security update	Nessus	Debian Local Security Checks	medium
108508	FreeBSD : Loofah -- XSS vulnerability (ba6d0c9b-f5f6-4b9b-a6de-3cce93c83220)	Nessus	FreeBSD Local Security Checks	medium

CVE-2018-8048

medium

Tenable Plugins

medium

medium