Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2021.1066
jquery security update
26 March 2021
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: jquery
Publisher: Debian
Operating System: Debian GNU/Linux
Impact/Access: Execute Arbitrary Code/Commands -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2020-11023 CVE-2020-11022
Reference: ASB-2021.0032
ASB-2021.0030
ASB-2020.0226
ASB-2020.0195
ASB-2020.0193
ASB-2020.0177
ESB-2021.0845
Original Bulletin:
https://lists.debian.org/debian-lts-announce/2021/03/msg00033.html
- --------------------------BEGIN INCLUDED TEXT--------------------
- -------------------------------------------------------------------------
Debian LTS Advisory DLA-2608-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Roberto C. Sanchez
March 25, 2021 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------
Package : jquery
Version : 3.1.1-2+deb9u2
CVE ID : CVE-2020-11022 CVE-2020-11023
Two vulnerabilities have been discovered in jquery's handling of
untrusted HTML which may result in execution of untrusted code.
For Debian 9 stretch, these problems have been fixed in version
3.1.1-2+deb9u2.
We recommend that you upgrade your jquery packages.
For the detailed security status of jquery please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/jquery
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
- -----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEIYZ1DR4ae5UL01q7ldFmTdL1kUIFAmBdOaUACgkQldFmTdL1
kUL+uxAAr6Gz29vRyTqtDhFj3GNYbDxBa2zbpVADYcTjQRJA+Oif7sa2SonkpMCr
4OTLsccGJclZDaCwC90nECLdMoqvNvS534cL1U9HpBg2qg6NPHT8MlMCBzmOmezn
ESjtVR4whaPcgESuFjPZLdBkxcj15NviYjDPw3nnhvM6i10EP63CRT3SUdTEwq2R
1aqOoicU9Bo2uahtlQtq7GEPFAfhZcaURZiT7BXCPp+FvayZ9MJU+u1JHXjVt511
9bm3aIR3UL3pWZ0h0Bv5yrpB5uzYCIkspzPUnYFPoqOwJWK6oahymyihzg+9DQtU
uTgGEsQ+PLc4NPapVT6IsLTz9/pNFVO/LjLroCzpGjIwcIbsPDOUdj4ROANm7Mac
Y0pUH/yenwdUzReqzvRGjcfrcMwzhqYcZJaSmPt1ni0a+ZZ9Lo8nx5cMhRdwWntc
ztz8NnbbB0Kbx35+6pDJc6+gkznaFcYXMXOqO89to0bp5ihOHyKMP46ToBsuc1uQ
tD9Tnlr4ruE66h3AwFYBjgEhM8yvCD77ApLFa2jtnB7+WCT6gND9Jq41oNhQGawB
X7BVUA/WjGEgxH7Iuz++o3V5UIat6JBVB08EQgoEnPeizRTml41tMBDLqi1j4fJ3
DIFxEzE53InJCfxFv6QN0RyEgc+JVDV3k4ZLIM6r7wF0UzcticE=
=z/Bk
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBYF1eD+NLKJtyKPYoAQidTA//Z0OGgzuad9TFv+OD3szAGChli0wgpWMx
YmA45GUOixaUiS3IHKI3m+uqdBLk5Cumkv/1uSUtzxZunPw5n76M5Bo/9b09kmv8
81IUs5fU7rKEq+ekKB1nwO7Edl2CiPtcJijhVxPAMRM9eTyFAtT9D33nfLQM/MtT
0U+pJ3hJuyYOYy0LSamn0XidcHzzaFbYje4KqC/s6ptfoQ9eW8uQck+RXHkwrD9c
by7aYwNEvYXGkSbrE2LkGQhdSQZf/SvDjH9Pd1Q+GpYaA02oBuCZ+b0r74upb/Jo
d8RPKJyMRYOYnnYiMd/RmjSuqwjQ79oB1UVcZgmbZkzdoeogMd4fM07D9qSndrDc
ZTX5Zs1jCZaFJTQE9yTeWp5yRC6QShPv95uKyQS8TqqRVsXMaygmcdQPuiLN/jSA
jrx+2wfxdzfyVryUy1V/VgixkPjz8Rrffa6N4+4xh3nwcVIuOemigRfkl3Hhg+sa
G1c7/XZfk3PwWexySeVb2NVZNc2+tOV9PeumBJCT6M+7BNJ39Um9Sq7y7DZaISR+
1gkXdTl0XZ3pKIYRtCOg5lDQBATzuAeLdSchJTlBK/xt2osTZl2dLUTuZVHRwKB7
wSYSdISUjyha1rAudZGE1Izwg+zKMMQMY3c/kGUFOuCfS4P1yRijAd73Bla71/gX
Hjf/K/Fqno4=
=sPXD
-----END PGP SIGNATURE-----