SUSE-SU-2023:3534-1: rubygem-rails-html-sanitizer&distro=SUSE OpenStack Cloud Crowbar 8 SUSE Linux Enterprise

CVSS: UnknownPublished

Published 05-09-2023Last modified 04-02-2026

Vulnerability summary

SUSE-SU-2023:3534-1 is a vulnerability in rubygem-rails-html-sanitizer&distro=SUSE OpenStack Cloud Crowbar 8 SUSE Linux Enterprise with no CVSS score yet.

Overall risk

0/100

0100

Minimal · default modelHow is this calculated?

CVSS score

Not scored

010

No CVSS score recorded

EPSS score

Not scored

0%100%

No EPSS score yet

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 4 · Downstream 0 · Related 4

CVE-2022-23517 CVE-2022-23518 CVE-2022-23519 CVE-2022-23520

Timeline

05-09-2023
PublishedVulnerability first disclosed.
04-02-2026
Last modifiedVulnerability information updated.

Description

Security update for rubygem-rails-html-sanitizer This update for rubygem-rails-html-sanitizer fixes the following issues: - CVE-2022-23517: Fixed inefficient regular expression that is susceptible to excessive backtracking (bsc#1206433). - CVE-2022-23518: Fixed XSS via data URIs when used in combination with Loofah (bsc#1206434). - CVE-2022-23519: Fixed XSS vulnerability with certain configurations of Rails::Html::Sanitizer (bsc#1206435). - CVE-2022-23520: Fixed XSS vulnerability with certain configurations of Rails::Html::Sanitizer (bsc#1206436).

CVSS metrics

Risk metrics not yet published.

EPSS trend

No EPSS score has been published for this record yet.

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Suse2 products

rubygem-rails-html-sanitizer&distro=SUSE OpenStack Cloud Crowbar 8< 1.0.3-8.14.1
rubygem-rails-html-sanitizer&distro=SUSE OpenStack Cloud Crowbar 9< 1.0.3-8.14.1

1 vendor · 2 products

References

9 links