nesting-based mutation XSS vulnerability
CVE: CVE-2024-47875
Component: dompurify
CWE: CWE-79
Severity: Important
CVSS v3: 8.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
Release date: 2024-10-11T15:15:05.860000+00:00

A flaw was found in DOMPurify that could allow for a nesting-based mXSS to not be properly sanitized.


Remediation:
For OpenShift Container Platform 4.11 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:

https://docs.openshift.com/container-platform/4.11/release_notes/ocp-4-11-release-notes.html

For Red Hat OpenShift Logging 5.6, see the following instructions to apply this update:

https://docs.openshift.com/container-platform/4.11/logging/cluster-logging-upgrading.html
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
For OpenShift Container Platform 4.14 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.14/release_notes/ocp-4-14-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:f4c6252655cea21b790ab6bd8d88da9a657d787a365cedf79bcab8371eb11290

      (For s390x architecture)
      The image digest is sha256:b7a9b6bebff381cd86dd38747a43045fba0f2ff1903c87ac551d7cada723ebcb

      (For ppc64le architecture)
      The image digest is sha256:6823347a606e8ea4e08708bbc8ca3fefa60f3b2659d86478885b6f7405baf14b

      (For aarch64 architecture)
      The image digest is sha256:870cc14058a63d173f50f7a2f8d0140e48e6f283bc8521584f1e73002cc17d5f

All OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.14/updating/updating_a_cluster/updating-cluster-cli.html
For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.15/release_notes/ocp-4-15-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:bcc1b1803a49b9ac876a7dd950138439aacb81f070a64ae0a2f16e01594b7291

      (For s390x architecture)
      The image digest is sha256:a30a4b62995d123fd352ca1676847414e55c7728b23655435d5fce4227d6a486

      (For ppc64le architecture)
      The image digest is sha256:f8d27d42b75c58ae8bf89820ee089893fdeeebfe6b80dd0481994da9e9c6c7a0

      (For aarch64 architecture)
      The image digest is sha256:16f31d7b926ce2bdae0e4bf911fffb68d30b449870c99c6411c9ecc0648d7b91

All OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.15/updating/updating_a_cluster/updating-cluster-cli.html
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
For OpenShift Container Platform 4.13 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:

https://docs.openshift.com/container-platform/4.13/release_notes/ocp-4-13-release-notes.html

For Red Hat OpenShift Logging 5.8, see the following instructions to apply this update:

https://docs.openshift.com/container-platform/4.13/logging/cluster-logging-upgrading.html
For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.16/release_notes/ocp-4-16-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:5b71d2917773c2fddcd0415fbc96457188df2ba87d71680330aa4cb96f4501b5

      (For s390x architecture)
      The image digest is sha256:111db21ce0dc822b64ee7751970a0008a03e43e04e8a87d2a0a2144afa7629e5

      (For ppc64le architecture)
      The image digest is sha256:26739c481fe13efb87105b83674786071d5f837b2f041470a01b4d3bf28c4b1d

      (For aarch64 architecture)
      The image digest is sha256:e44980c6d97f3183c88748350c04c201b102cf4503a62b105b2ed34ebd9d7f58

All OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.16/updating/updating_a_cluster/updating-cluster-cli.html
For OpenShift Container Platform 4.17 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.17/release_notes/ocp-4-17-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:bada2d7626c8652e0fb68d3237195cb37f425e960347fbdd747beb17f671cf13

      (For s390x architecture)
      The image digest is sha256:8c07c2547eb4e4a62ad5b5cad83610239cd54d1e54dabf3ddb80aead4fd6cc1c

      (For ppc64le architecture)
      The image digest is sha256:91ff74d74084e8334a1f7961b630ee6d9e10f3960674ceb496c9452132a4509e

      (For aarch64 architecture)
      The image digest is sha256:fcb6eb3e470aad9d4fb51e2ae564e295b823b88d0e9d92129ea7b8ed53d6fb4e

All OpenShift Container Platform 4.17 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.17/updating/updating_a_cluster/updating-cluster-cli.html
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.