Bug 49535 – dojo 1.12.1: multiple issues (4.4)

Bug 49535 - dojo 1.12.1: multiple issues (4.4)


Summary:	dojo 1.12.1: multiple issues (4.4)

Status:	CLOSED DUPLICATE of bug 48963

Product:	UCS
Classification:	Unclassified
Component:	Security updates
Version:	UCS 4.4
Hardware:	Other Linux

Importance:	P5 normal (vote)
Target Milestone:	UCS 5.0
Assigned To:	Florian Best
QA Contact:	Johannes Keiser

URL:	https://www.cvedetails.com/vulnerabil...
Keywords:

Depends on:	42291
Blocks:
	Show dependency tree / graph

Reported:	2019-05-23 17:56 CEST by Arvid Requate
Modified:	2021-05-25 16:00 CEST (History)
CC List:	4 users (show)

See Also:	48963
What kind of report is it?:	Security Issue
What type of bug is this?:	---
Who will be affected by this bug?:	---
How will those affected feel about the bug?:	---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):	Security
Max CVSS v3 score:	7.5 - 8 (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N)

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Arvid Requate

2019-05-23 17:56:42 CEST

The snyk npm monitor currently shows these vulnerabilities for the dojo toolkit:

* unescaped string injection in dojox/Grid/DataGrid (CVE-2018-15494)
  https://access.redhat.com/security/cve/cve-2018-15494

* https://security-tracker.debian.org/tracker/CVE-2018-1000665
  https://access.redhat.com/security/cve/cve-2018-1000665

* https://snyk.io/vuln/npm:dojo:20180818

Comment 1 Florian Best

2020-09-22 10:02:23 CEST


*** This bug has been marked as a duplicate of bug 48963 ***

Comment 2 Johannes Keiser

2021-03-15 11:08:42 CET

OK: duplicate

Comment 3 Florian Best

2021-05-25 16:00:05 CEST

UCS 5.0 has been released:
 https://docs.software-univention.de/release-notes-5.0-0-en.html
 https://docs.software-univention.de/release-notes-5.0-0-de.html

If this error occurs again, please use "Clone This Bug".