Security update for rubygem-actionview-4_2 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:2686-1 Final 1 1 2020-09-21T08:54:48Z current 2020-09-21T08:54:48Z 2020-09-21T08:54:48Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for rubygem-actionview-4_2 This update for rubygem-actionview-4_2 fixes the following issues: - CVE-2020-15169: Fix cross-site scripting in translation helpers (bsc#1176421) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2020-2686,SUSE-OpenStack-Cloud-6-LTSS-2020-2686,SUSE-OpenStack-Cloud-7-2020-2686,SUSE-OpenStack-Cloud-Crowbar-8-2020-2686,SUSE-OpenStack-Cloud-Crowbar-9-2020-2686 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-20202686-1/ Link for SUSE-SU-2020:2686-1 https://lists.suse.com/pipermail/sle-security-updates/2020-September/007446.html E-Mail link for SUSE-SU-2020:2686-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1176421 SUSE Bug 1176421 https://www.suse.com/security/cve/CVE-2020-15169/ SUSE CVE CVE-2020-15169 page SUSE OpenStack Cloud 6-LTSS SUSE OpenStack Cloud 7 SUSE OpenStack Cloud Crowbar 8 SUSE OpenStack Cloud Crowbar 9 ruby2.1-rubygem-actionview-4_2-4.2.9-9.12.1 ruby2.1-rubygem-actionview-doc-4_2-4.2.9-9.12.1 ruby2.1-rubygem-actionview-4_2-4.2.9-9.12.1 as a component of SUSE OpenStack Cloud 6-LTSS ruby2.1-rubygem-actionview-4_2-4.2.9-9.12.1 as a component of SUSE OpenStack Cloud 7 ruby2.1-rubygem-actionview-4_2-4.2.9-9.12.1 as a component of SUSE OpenStack Cloud Crowbar 8 ruby2.1-rubygem-actionview-4_2-4.2.9-9.12.1 as a component of SUSE OpenStack Cloud Crowbar 9 In Action View before versions 5.2.4.4 and 6.0.3.3 there is a potential Cross-Site Scripting (XSS) vulnerability in Action View's translation helpers. Views that allow the user to control the default (not found) value of the `t` and `translate` helpers could be susceptible to XSS attacks. When an HTML-unsafe string is passed as the default for a missing translation key named html or ending in _html, the default string is incorrectly marked as HTML-safe and not escaped. This is patched in versions 6.0.3.3 and 5.2.4.4. A workaround without upgrading is proposed in the source advisory. CVE-2020-15169 SUSE OpenStack Cloud 6-LTSS:ruby2.1-rubygem-actionview-4_2-4.2.9-9.12.1 SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionview-4_2-4.2.9-9.12.1 SUSE OpenStack Cloud Crowbar 8:ruby2.1-rubygem-actionview-4_2-4.2.9-9.12.1 SUSE OpenStack Cloud Crowbar 9:ruby2.1-rubygem-actionview-4_2-4.2.9-9.12.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20202686-1/ https://www.suse.com/security/cve/CVE-2020-15169.html CVE-2020-15169 https://bugzilla.suse.com/1176421 SUSE Bug 1176421