var-202004-2199

Vulnerability from variot

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0. jQuery is an open source, cross-browser JavaScript library developed by American John Resig programmers. The library simplifies the operation between HTML and JavaScript, and has the characteristics of modularization and plug-in extension. A cross-site scripting vulnerability exists in jQuery versions 1.0.3 through 3.5.0. The vulnerability stems from the lack of correct validation of client data in WEB applications. An attacker could exploit this vulnerability to execute client code. 8) - ppc64le, s390x, x86_64

1. Description:

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

The following packages have been upgraded to a later upstream version: pcs (0.10.10).

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.5 Release Notes linked from the References section. Bugs fixed (https://bugzilla.redhat.com/):

1290830 - [RFE] pcs command is missing a way to retrieve the status of a single resource 1432097 - pcs status nodes shows incomplete information when both standby and maintenance modes are set for a node 1678273 - Moving the last resource from a group may result in an invalid CIB 1690419 - Improve guest node error message when pacemaker_remote is running 1720221 - [RFE] Add support for corosync option totem.block_unlisted_ips 1759995 - [RFE] Need ability to add/remove storage devices with scsi fencing 1841019 - [TechPreview Exit][RFE] Add a 'local' cluster setup command 1850004 - CVE-2020-11023 jquery: Untrusted code execution via tag in HTML passed to DOM manipulation methods 1850119 - CVE-2020-7656 jquery: Cross-site scripting (XSS) via