REDHAT-BUG-2019144: Medium severity jquery ui vulnerability
jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the altField option of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the altField option is now treated as a CSS selector. A workaround is to not accept the value of the altField option from untrusted sources.
Reference: https://github.com/jquery/jquery-ui/security/advisories/GHSA-9gj3-hwp5-pmwc
Upstream patch: https://github.com/jquery/jquery-ui/pull/1954/commits/6809ce843e5ac4128108ea4c15cbc100653c2b63
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2019144?
The severity of REDHAT-BUG-2019144 is considered high due to the potential execution of untrusted code.
How do I fix REDHAT-BUG-2019144?
To fix REDHAT-BUG-2019144, upgrade to jQuery UI version 1.13.0 or later.
What component is affected by REDHAT-BUG-2019144?
The affected component in REDHAT-BUG-2019144 is the Datepicker widget in jQuery UI prior to version 1.13.0.
What are the implications of REDHAT-BUG-2019144 if not addressed?
If not addressed, REDHAT-BUG-2019144 could allow an attacker to inject and execute untrusted code through the altField option.
When was REDHAT-BUG-2019144 reported?
REDHAT-BUG-2019144 was reported prior to the release of jQuery UI version 1.13.0.