SB2020072971 - Security restrictions bypass in webkit2gtk (Alpine package)

Description

This security bulletin contains information about 1 vulnerability.

1) Security restrictions bypass (CVE-ID: CVE-2020-9915)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to application does not properly impose Content Security Policy. A remote attacker can create a specially crafted web page, trick the victim into visiting it and bypass implemented security restrictions. The vulnerability may allow an attacker to perform cross-site scripting attacks or gain access to sensitive information.

Remediation

Install update from vendor's website.

References

• https://git.alpinelinux.org/aports/commit/?id=fe214188a195f5576002285361735b8d7861fe87
• https://git.alpinelinux.org/aports/commit/?id=9b09c5117dcccee35e6c8387d68aeec904a8da77