Red Hat Security AdvisoryRHSA-2022:7343
pcs security update
Released 2022-11-02 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Server High Availability (v. 7) pcs-0.9.169-3.el7_9.3, pcs-snmp-0.9.169-3.el7_9.3
- Red Hat Enterprise Linux Server Resilient Storage (v. 7) pcs-0.9.169-3.el7_9.3, pcs-snmp-0.9.169-3.el7_9.3
Fixes 3 records
Priority CRITICAL 88KEV
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e.
CVSS 3.1MEDIUM 6.9· Network · No auth · User interaction · EPSS 0.84887 · Published 2020-04-29 · Partial fix · 3.5.0, 4.4.0 CWE-79
Priority HIGH 69
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.8682 · Published 2019-04-19 · Partial fix · 3.4.0, 4.3.4 +3 CWE-1321
Priority MEDIUM 47
A sequence injection vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 which could allow is a possible shell escape in the Lint and CommonLogger components of Rack.
CVSS 3.1CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.01955 · Published 2022-12-05 · Partial fix · 2.0.9.1, 2.1.4.1 +1 CWE-150
THREATIST.IORead the docs