Abea Apostrophe Technologies sanitize-html 安全漏洞

漏洞信息详情

Abea Apostrophe Technologies sanitize-html是美国Abea组织的一个清除格式工具。提供了带有清晰API的简单HTML标签清除。

Apostrophe Technologies sanitize-html 2.3.1之前版本存在安全漏洞，该漏洞源于不能正确处理国际化域名(IDN)，这可能会让攻击者绕过 allowedIframeHostnames 选项设置的主机名白名单验证。

目前厂商已发布升级补丁以修复漏洞，补丁获取链接：

https://github.com/apostrophecms/sanitize-html/blob/main/CHANGELOG.md#231-2021-01-22

来源:MISC

链接:https://advisory.checkmarx.net/advisory/CX-2021-4308

来源:MISC

链接:https://github.com/apostrophecms/sanitize-html/pull/458

来源:MISC

链接:https://github.com/apostrophecms/sanitize-html/blob/main/CHANGELOG.md#231-2021-01-22

来源:www.auscert.org.au

链接:https://www.auscert.org.au/bulletins/ESB-2021.2555

来源:www.auscert.org.au

链接:https://www.auscert.org.au/bulletins/ESB-2021.3466

来源:packetstormsecurity.com

链接:https://packetstormsecurity.com/files/164543/Red-Hat-Security-Advisory-2021-3759-01.html

来源:nvd.nist.gov

链接:https://nvd.nist.gov/vuln/detail/CVE-2021-26539

暂无