Affected: AlmaLinux:8: bind-dyndb-ldap, AlmaLinux:8: custodia, AlmaLinux:8: opendnssec, AlmaLinux:8: python3-custodia, AlmaLinux:8: python3-jwcrypto, AlmaLinux:8: python3-kdcproxy, AlmaLinux:8: python3-pyusb, AlmaLinux:8: python3-qrcode, AlmaLinux:8: python3-qrcode-core, AlmaLinux:8: python3-yubico and 2 more

AlmaLinux Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments.

Security Fix(es):

* jquery: Passing HTML containing <option> elements to manipulation methods could result in untrusted code execution (CVE-2020-11023)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Affected: Bitnami: drupal

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Affected: CleanStart: cacti, CleanStart: drupal7

CVE-2020-11023 affects multiple packages. In jQuery versions greater than or equal to 1. See references for individual vulnerability details.

Moderate: tbb security update

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Starting with Festo Automation Suite (FAS) version 2.8.0.138, the suite is delivered only with a connector to Codesys, rather than including Codesys directly. Prior to this version, Codesys was bundled within the FAS installation. From version 2.8.0.138 onwards, customers are required to download and install Codesys independently.

This change impacts the handling of security vulnerabilities (CVEs) related to Codesys. Any Codesys-related security issues must now be addressed by the customer through their separate Codesys installation. The FAS itself includes only the connector component, which is maintained and updated within the suite.

Please ensure that Codesys is kept up to date independently to mitigate any potential security risks associated with the Codesys software.

Affected: npm: jquery, RubyGems: jquery-rails, NuGet: jQuery, Maven: org.webjars.npm:jquery, Packagist: components/jquery

### Impact Passing HTML containing `<option>` elements from untrusted sources - even after sanitizing them - to one of jQuery's DOM manipulation methods (i.e. `.html()`, `.append()`, and others) may execute untrusted code.

### Patches This problem is patched in jQuery 3.5.0.

### Workarounds To workaround this issue without upgrading, use [DOMPurify](https://github.com/cure53/DOMPurify) with its `SAFE_FOR_JQUERY` option to sanitize the HTML string before passing it to a jQuery method.

### References https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/

### For more information If you have any questions or comments about this advisory, search for a relevant issue in [the jQuery repo](https://github.com/jquery/jquery/issues). If you don't find an answer, open a new issue.

A vulnerability in the JQuery web user interface (UI) component could allow a webpage to be altered before it is served to users.CVE-2020-11023 has been assigned to this vulnerability. A CVSS v3 base score of 6.1 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods

Schneider Electric is aware of a vulnerability in its System Monitor application of Harmony Industrial PC and Pro-face PS5000 trusted Legacy industrial PC series products. The Harmony Industrial PC Series and Pro-face PS5000 legacy industrial PC Series are iPCs which incorporate slim, flexible and durable design allowing each customer to configure their iPC based on their individual application needs. These products offer flexible connectivity to a range of devices and designs. Failure to apply the remediations provided below may risk untrusted code execution which could result in operational failures.

Affected: Ubuntu:Pro:14.04:LTS: drupal7, Ubuntu:Pro:16.04:LTS: drupal7, Ubuntu:Pro:18.04:LTS: jquery, Ubuntu:20.04:LTS: jquery

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Critical vulnerabilities have been discovered in the product and in the utilized components jQuery by jQuery Team and TLS Version 1.0/1.1.

The impact of the vulnerabilities on the affected device may result in

- denial of service - remote code execution - code exposure

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in jQuery ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.