[DRE-maint] Bug#1041430: ruby-sanitize: CVE-2023-36823

[Moritz Mühlenhoff]

Source: ruby-sanitize
X-Debbugs-CC: team at security.debian.org
Severity: grave
Tags: security

Hi,

The following vulnerability was published for ruby-sanitize.

CVE-2023-36823[0]:
| Sanitize is an allowlist-based HTML and CSS sanitizer. Using
| carefully crafted input, an attacker may be able to sneak arbitrary
| HTML and CSS through Sanitize starting with version 3.0.0 and prior
| to version 6.0.2 when Sanitize is configured to use the built-in
| "relaxed" config or when using a custom config that allows `style`
| elements and one or more CSS at-rules. This could result in cross-
| site scripting or other undesired behavior when the malicious HTML
| and CSS are rendered in a browser. Sanitize 6.0.2 performs
| additional escaping of CSS in `style` element content, which fixes
| this issue. Users who are unable to upgrade can prevent this issue
| by using a Sanitize config that doesn't allow `style` elements,
| using a Sanitize config that doesn't allow CSS at-rules, or by
| manually escaping the character sequence `</` as `<\/` in `style`
| element content.

https://github.com/rgrove/sanitize/commit/76ed46e6dc70820f38efe27de8dabd54dddb5220 (v6.0.2)
https://github.com/rgrove/sanitize/security/advisories/GHSA-f5ww-cq3m-q3g7
  

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2023-36823
    https://www.cve.org/CVERecord?id=CVE-2023-36823

Please adjust the affected versions in the BTS as needed.