USN-4498-1: Loofah vulnerability
15 September 2020
Loofah could be made to perform XSS attacks if a crafted SVG element is republished
Releases
Packages
- ruby-loofah - manipulation and transformation of HTML/XML documents and fragments
Details
It was discovered that Loofah does not properly sanitize JavaScript in
sanitized output. An attacker could possibly use this issue to perform
XSS attacks. (CVE-2019-15587)
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 16.04
In general, a standard system update will make all the necessary changes.