prototypejs: CVE-2020-27511

Debian Bug report logs - #991898
prototypejs: CVE-2020-27511

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: prototypejs: CVE-2020-27511

Date: Wed, 04 Aug 2021 19:38:00 +0200

Source: prototypejs
Version: 1.7.1-3.1
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>
Control: found -1 1.7.1-3

Hi,

The following vulnerability was published for prototypejs.

CVE-2020-27511[0]:
| An issue was discovered in the stripTags and unescapeHTML components
| in Prototype 1.7.3 where an attacker can cause a Regular Expression
| Denial of Service (ReDOS) through stripping crafted HTML tags.

Basically this bug is just to track the issue downstream for us in
Debian. Though upstream's last release was several years ago in 2015,
so I wonder if post-bullseye release this bug severity should be
raised to RC.

There are many (build)-rdeps on it so this cannot simply be removed
from the archive.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2020-27511
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27511
[1] https://github.com/yetingli/PoCs/blob/main/CVE-2020-27511/Prototype.md

Regards,
Salvatore

Message #12 received at 991898@bugs.debian.org (full text, mbox, reply):

From: Neil Williams <codehelp@debian.org>

To: 991898@bugs.debian.org

Cc: Debian Javascript Maintainers <pkg-javascript-devel@lists.alioth.debian.org>

Subject: Re: prototypejs: CVE-2020-27511

Date: Thu, 5 Aug 2021 12:19:06 +0100

[Message part 1 (text/plain, inline)]

On Wed, 04 Aug 2021 19:38:00 +0200 Salvatore Bonaccorso
<carnil@debian.org> wrote:
> 
> The following vulnerability was published for prototypejs.
> 
> CVE-2020-27511[0]:
> | An issue was discovered in the stripTags and unescapeHTML components
> | in Prototype 1.7.3 where an attacker can cause a Regular Expression
> | Denial of Service (ReDOS) through stripping crafted HTML tags.

(The CVE mentions a newer version but vulnerable code exists in older
versions too.)

The Debian package has been orphaned and upstream has not seen any
changes on the master branch since April 2017. (Last upload of a new
upstream release to Debian was in 2013.)

Nevertheless, there is a pull request which claims to address the
problem in strip_tags, opened in Jan 2021:

https://github.com/prototypejs/prototype/pull/349


> Basically this bug is just to track the issue downstream for us in
> Debian. Though upstream's last release was several years ago in 2015,
> so I wonder if post-bullseye release this bug severity should be
> raised to RC.
> 
> There are many (build)-rdeps on it so this cannot simply be removed
> from the archive.

CC'ing the Javascript team in case someone there can take over the
package, possibly upstream as well as in Debian.

libjs-prototype
Reverse Depends:
  libjs-flotr
  wims
  citadel-webcit
  chromium-tt-rss-notifier
  smokeping
  libjs-scriptaculous
  rabbit
  libjs-protoaculous
  php-horde-core
  mobyle
  libjs-jstorage
  libhtml-prototype-perl
  libembperl-perl
  libaws18-dev
  jsxgraph
  gnat-gps-common
  gerbera
  gbrowse
  fusiondirectory
  darktable

> If you fix the vulnerability please also make sure to include the
> CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
> 
> For further information see:
> 
> [0] https://security-tracker.debian.org/tracker/CVE-2020-27511
>     https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27511
> [1]
> https://github.com/yetingli/PoCs/blob/main/CVE-2020-27511/Prototype.md
> 
> Regards,
> Salvatore
> 
> 



-- 
Neil Williams
=============
https://linux.codehelp.co.uk/

[Message part 2 (application/pgp-signature, inline)]

Send a report that this bug log contains spam.