Cross-site scripting in redcarpet - CVE-2020-26298

Vulnerability identifier: #VU49588

CSH Severity: Medium

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

CVE-ID: CVE-2020-26298

CWE-ID: CWE-79

Exploitation vector: Remote access

Exploit availability: No public exploit available

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

redcarpet
ruby-redcarpet (Debian package)
python-Django
ruby2.1-rubygem-puma
ruby2.1-rubygem-puma-debuginfo
rubygem-puma-debugsource
ruby2.1-rubygem-redcarpet
ruby2.1-rubygem-redcarpet-debuginfo
rubygem-redcarpet-debugsource
rubygem-redcarpet
rubygem-redcarpet-doc
rubygem-redcarpet-debuginfo
documentation-suse-openstack-cloud-planning
documentation-hpe-helion-openstack-user
documentation-hpe-helion-openstack-security
documentation-hpe-helion-openstack-planning
documentation-hpe-helion-openstack-opsconsole
documentation-hpe-helion-openstack-operations
documentation-hpe-helion-openstack-installation
documentation-suse-openstack-cloud-user
documentation-suse-openstack-cloud-security
documentation-suse-openstack-cloud-opsconsole
documentation-suse-openstack-cloud-operations
documentation-suse-openstack-cloud-installation
documentation-suse-openstack-cloud-upstream-user
documentation-suse-openstack-cloud-upstream-admin
documentation-suse-openstack-cloud-supplement
documentation-suse-openstack-cloud-deployment
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
HPE Helion Openstack
openEuler
Fedora

Install updates from vendor's website.

redcarpet - update to 3.5.1
ruby-redcarpet (Debian package) - update to 3.4.0-4+deb10u1
python-Django - update to 1.11.29-3.28.1
ruby2.1-rubygem-puma - update to 2.16.0-3.15.1
ruby2.1-rubygem-puma-debuginfo - update to 2.16.0-3.15.1
rubygem-puma-debugsource - update to 2.16.0-3.15.1
ruby2.1-rubygem-redcarpet - update to 3.2.3-3.3.1
ruby2.1-rubygem-redcarpet-debuginfo - update to 3.2.3-3.3.1
rubygem-redcarpet-debugsource - update to 3.2.3-3.3.1
rubygem-redcarpet - addressed in versions 3.3.2-26.fc36, 3.3.2-26.fc37, 3.3.2-26.fc38
rubygem-redcarpet-doc - update to 3.5.1-1
rubygem-redcarpet - update to 3.5.1-1
rubygem-redcarpet-debuginfo - update to 3.5.1-1
rubygem-redcarpet-debugsource - update to 3.5.1-1
documentation-suse-openstack-cloud-planning - update to 8.20210806-1.35.1
documentation-hpe-helion-openstack-user - update to 8.20210806-1.35.1
documentation-hpe-helion-openstack-security - update to 8.20210806-1.35.1
documentation-hpe-helion-openstack-planning - update to 8.20210806-1.35.1
documentation-hpe-helion-openstack-opsconsole - update to 8.20210806-1.35.1
documentation-hpe-helion-openstack-operations - update to 8.20210806-1.35.1
documentation-hpe-helion-openstack-installation - update to 8.20210806-1.35.1
documentation-suse-openstack-cloud-user - update to 8.20210806-1.35.1
documentation-suse-openstack-cloud-security - update to 8.20210806-1.35.1
documentation-suse-openstack-cloud-opsconsole - update to 8.20210806-1.35.1
documentation-suse-openstack-cloud-operations - update to 8.20210806-1.35.1
documentation-suse-openstack-cloud-installation - update to 8.20210806-1.35.1
documentation-suse-openstack-cloud-upstream-user - update to 8.20210806-1.35.1
documentation-suse-openstack-cloud-upstream-admin - update to 8.20210806-1.35.1
documentation-suse-openstack-cloud-supplement - update to 8.20210806-1.35.1
documentation-suse-openstack-cloud-deployment - update to 8.20210806-1.35.1

• https://github.com/advisories/GHSA-q3wr-qw3g-3p4h
• https://github.com/vmg/redcarpet/blob/master/CHANGELOG.md#version-351-security
• https://github.com/vmg/redcarpet/commit/a699c82292b17c8e6a62e1914d5eccc252272793
• https://lists.debian.org/debian-lts-announce/2021/01/msg00014.html
• https://rubygems.org/gems/redcarpet
• https://www.debian.org/security/2021/dsa-4831

• Cross-site scripting in Redcarpet library for Ruby
• Debian update for ruby-redcarpet
• SUSE update for ardana-ansible, ardana-monasca, documentation-suse-openstack-cloud, openstack-ec2-api, openstack-heat-templates, python-Django, python-monasca-common, rubygem-redcarpet, rubygem-puma
• Fedora 38 update for rubygem-redcarpet
• Fedora 37 update for rubygem-redcarpet
• Fedora 36 update for rubygem-redcarpet
• openEuler 20.03 LTS SP1 update for rubygem-redcarpet