[ASA-202101-8] mdbook: cross-site scripting

[Morten Linderud]

Arch Linux Security Advisory ASA-202101-8
=========================================

Severity: Medium
Date    : 2021-01-12
CVE-ID  : CVE-2020-26297
Package : mdbook
Type    : cross-site scripting
Remote  : Yes
Link    : https://security.archlinux.org/AVG-1399

Summary
=======

The package mdbook before version 0.4.5-1 is vulnerable to cross-site
scripting.

Resolution
==========

Upgrade to 0.4.5-1.

# pacman -Syu "mdbook>=0.4.5-1"

The problem has been fixed upstream in version 0.4.5.

Workaround
==========

None.

Description
===========

The search feature of mdBook (introduced in version 0.1.4) was affected
by a cross site scripting vulnerability that allowed an attacker to
execute arbitrary JavaScript code on an user's browser by tricking the
user into typing a malicious search query, or tricking the user into
clicking a link to the search page with the malicious search query
prefilled. mdBook 0.4.5 fixes the vulnerability by properly escaping
the search query.

Impact
======

A malicious user can execute arbitrary code in a user's browser with a
malicious search query.

References
==========

https://groups.google.com/g/rustlang-security-announcements/c/3-sO6of29O0
https://github.com/rust-lang/mdBook/commit/648c9ae772bec83f0a5954d17b4287d5bb1d6606
https://security.archlinux.org/CVE-2020-26297
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20210115/1f550fa3/attachment.sig>