This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2018-3740 →

DEBIAN-CVE-2018-3740

A specially crafted HTML fragment can cause Sanitize gem for Ruby to allow non-whitelisted attributes to be used on a whitelisted HTML element.

Original description

The description as published by the source.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Debian:12 ruby-sanitize

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.6-1"}]}]

Debian:13 ruby-sanitize

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.6-1"}]}]

Debian:14 ruby-sanitize

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.6-1"}]}]