freeipa

#8783 CVE-2020-1935 affects FreeIPA on port 8443
Closed: invalid by abbra. Opened by darvasip.

Closed: invalid
Reopen Issue

Request for enhancement

I would like to highlight an existing security (CVE-2020-1935) vulnerability affecting FreeIPA 4.6.8-5, coming from CentOS repo.

Issue

JQuery 1.2 < 3.5.0 Multiple XSS
The Tomcat web server on port 8443 is affected by multiple cross site scripting vulnerability. According to the self-reported version in the script, the version of JQuery hosted on the remote web server is greater than or equal to 1.2 and prior to 3.5.0 (1.10.2 jquery version in :8443/pki/js/jquery.js).

It is, therefore, affected by multiple cross site scripting vulnerabilities.

According to the "RHSA-2020:3936 - Security Advisory", it has a fix for
jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)
https://access.redhat.com/errata/RHSA-2020:3936

I assume it was fixed for the server running on 8080 but not for the Tomcat running on 8443.

Steps to Reproduce

  1. Launch ipa-server 4.6.8-5, coming from official CentOS repo
  2. check jQuery on port 8443 --> 1.10.2

Expected behavior

Upgrade to JQuery version 3.5.0 or later

Version/Release/Distribution

ipa-server 4.6.8-5, coming from CentOS repo

Additional info:

Related links:
https://bugzilla.redhat.com/show_bug.cgi?id=1828406
https://access.redhat.com/security/cve/cve-2020-11022
https://access.redhat.com/errata/RHSA-2020:3936

The applications exposed through tomcat are part of Dogtag, not FreeIPA. Dogtag did release a number of fixes over last few weeks. When these fixes would appear in CentOS is not under control of FreeIPA or Dogtag teams.

I am closing this bug because it has nothing to do with FreeIPA upstream, sorry.

Metadata Update from @abbra:
- Issue close_status updated to: invalid
- Issue status updated to: Closed (was: Open)

@abbra Do you know where to report this to have the highest chance of a fix?

"these fixes would appear in CentOS is not under control of FreeIPA or Dogtag teams."

Also, do you know who is controlling this decision?

For everything about CentOS itself please talk to CentOS project people. I am sorry but FreeIPA upstream development team has nothing to do with that. We also are waiting for updates of CentOS packages with no ability to force those updates ourselves.
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.