Cross-site Scripting (XSS) Affecting librbd1-devel package, versions *
Threat Intelligence
EPSS
0.56% (78th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RHEL7-LIBRBD1DEVEL-4415137
- published 1 Nov 2021
- disclosed 6 Apr 2020
How to fix?
There is no fixed version for RHEL:7 librbd1-devel.
NVD Description
Note: Versions mentioned in the description apply only to the upstream librbd1-devel package and not the librbd1-devel package as distributed by RHEL.
See How to fix? for RHEL:7 relevant fixed versions and status.
A flaw was found in the Ceph Object Gateway, where it supports request sent by an anonymous user in Amazon S3. This flaw could lead to potential XSS attacks due to the lack of proper neutralization of untrusted input.
References
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1760
- https://access.redhat.com/security/cve/CVE-2020-1760
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P3A2UFR5IUIEXJUCF64GQ5OVLCZGODXE/
- https://security.gentoo.org/glsa/202105-39
- https://www.openwall.com/lists/oss-security/2020/04/07/1
- https://lists.debian.org/debian-lts-announce/2021/08/msg00013.html
- https://usn.ubuntu.com/4528-1/
- https://lists.debian.org/debian-lts-announce/2023/10/msg00034.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P3A2UFR5IUIEXJUCF64GQ5OVLCZGODXE/
CVSS Scores
version 3.1