FLAT-J7PDE – Vulnerability | Fluid Attacks Database

Database

Description

In the Loofah gem through 2.2.0 for Ruby, non-whitelisted HTML attributes may occur in sanitized output by republishing a crafted HTML fragment.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
rubygems	nokogiri	>=0 <1.8.3	1.8.3
rubygems	loofah	>=0 <2.2.1	2.2.1
debian 14	ruby-loofah	>=0 <2.2.1-1	2.2.1-1
debian 12	ruby-loofah	>=0 <2.2.1-1	2.2.1-1
debian 13	ruby-loofah	>=0 <2.2.1-1	2.2.1-1

Aliases

1. CVE-2018-80482. NVD-2018-80483. OSV-2018-80484. OSV-DEBIAN-2018-80485. GHSA-x7rv-cr6v-4vm46. GCVE-2018-80487. SECURITY-TRACKER-CVE-2018-8048

References

1. https://github.com/flavorjones/loofah/issues/1442. https://github.com/sparklemotion/nokogiri/pull/17463. https://github.com/flavorjones/loofah/commit/f739cf8eac5851f328b8044281d6653f74eff1164. https://github.com/flavorjones/loofah5. https://github.com/rubysec/ruby-advisory-db/blob/master/gems/loofah/CVE-2018-8048.yml6. https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2018-8048.yml7. https://security.netapp.com/advisory/ntap-20191122-00038. https://www.debian.org/security/2018/dsa-41719. http://www.openwall.com/lists/oss-security/2018/03/19/5

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.