RHSA-2025:1983

Vulnerability from csaf_redhat - Published: 2025-03-05 13:38 - Updated: 2026-04-01 13:13
Summary
Red Hat Security Advisory: Logging for Red Hat OpenShift - 5.8.18
Severity
Moderate
Notes
Topic: Logging for Red Hat OpenShift - 5.8.18
Details: Logging for Red Hat OpenShift - 5.8.18 logging-kibana6-container: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods (CVE-2020-11023)
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2020-11023

A flaw was found in jQuery. HTML containing \<option\> elements from untrusted sources are passed, even after sanitizing, to one of jQuery's DOM manipulation methods, which may execute untrusted code. The highest threat from this vulnerability is to data confidentiality and integrity.

6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vendor Fix For OpenShift Container Platform 4.13 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.openshift.com/container-platform/4.13/release_notes/ocp-4-13-release-notes.html For Red Hat OpenShift Logging 5.8, see the following instructions to apply this update: https://docs.openshift.com/container-platform/4.13/logging/cluster-logging-upgrading.html https://access.redhat.com/errata/RHSA-2025:1983
Workaround Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.
References
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Logging for Red Hat OpenShift - 5.8.18",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Logging for Red Hat OpenShift - 5.8.18\nlogging-kibana6-container: Untrusted code execution via \u003coption\u003e tag in HTML passed to DOM manipulation methods (CVE-2020-11023)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2025:1983",
        "url": "https://access.redhat.com/errata/RHSA-2025:1983"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_1983.json"
      }
    ],
    "title": "Red Hat Security Advisory: Logging for Red Hat OpenShift - 5.8.18",
    "tracking": {
      "current_release_date": "2026-04-01T13:13:42+00:00",
      "generator": {
        "date": "2026-04-01T13:13:42+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.7.4"
        }
      },
      "id": "RHSA-2025:1983",
      "initial_release_date": "2025-03-05T13:38:18+00:00",
      "revision_history": [
        {
          "date": "2025-03-05T13:38:18+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2025-03-05T13:38:18+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-04-01T13:13:42+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "RHOL 5.8 for RHEL 8",
                "product": {
                  "name": "RHOL 5.8 for RHEL 8",
                  "product_id": "8Base-RHOL-5.8",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:logging:5.8::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "logging for Red Hat OpenShift"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openshift-logging/kibana6-rhel8@sha256:fff31521cd7e8533be31f39eda05d47fb8986fbeb144819cec3761e3b1e1ba32_amd64",
                "product": {
                  "name": "openshift-logging/kibana6-rhel8@sha256:fff31521cd7e8533be31f39eda05d47fb8986fbeb144819cec3761e3b1e1ba32_amd64",
                  "product_id": "openshift-logging/kibana6-rhel8@sha256:fff31521cd7e8533be31f39eda05d47fb8986fbeb144819cec3761e3b1e1ba32_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kibana6-rhel8@sha256:fff31521cd7e8533be31f39eda05d47fb8986fbeb144819cec3761e3b1e1ba32?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/kibana6-rhel8\u0026tag=v6.8.1-479"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openshift-logging/kibana6-rhel8@sha256:571d43bc602450e0883ec5aa3e7d44a00413be545ab4c0a67db48cd7c1e77b3b_ppc64le",
                "product": {
                  "name": "openshift-logging/kibana6-rhel8@sha256:571d43bc602450e0883ec5aa3e7d44a00413be545ab4c0a67db48cd7c1e77b3b_ppc64le",
                  "product_id": "openshift-logging/kibana6-rhel8@sha256:571d43bc602450e0883ec5aa3e7d44a00413be545ab4c0a67db48cd7c1e77b3b_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kibana6-rhel8@sha256:571d43bc602450e0883ec5aa3e7d44a00413be545ab4c0a67db48cd7c1e77b3b?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/kibana6-rhel8\u0026tag=v6.8.1-479"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openshift-logging/kibana6-rhel8@sha256:11bfe43b2b6372dfedee47ef10ec0ec67bb7070265f579dd512a36e2ff691ff6_s390x",
                "product": {
                  "name": "openshift-logging/kibana6-rhel8@sha256:11bfe43b2b6372dfedee47ef10ec0ec67bb7070265f579dd512a36e2ff691ff6_s390x",
                  "product_id": "openshift-logging/kibana6-rhel8@sha256:11bfe43b2b6372dfedee47ef10ec0ec67bb7070265f579dd512a36e2ff691ff6_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kibana6-rhel8@sha256:11bfe43b2b6372dfedee47ef10ec0ec67bb7070265f579dd512a36e2ff691ff6?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/kibana6-rhel8\u0026tag=v6.8.1-479"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openshift-logging/kibana6-rhel8@sha256:3edcb9e5f595f43560c2d1a9cd643ba3a47052d64d02ffb239aa514444c7ffca_arm64",
                "product": {
                  "name": "openshift-logging/kibana6-rhel8@sha256:3edcb9e5f595f43560c2d1a9cd643ba3a47052d64d02ffb239aa514444c7ffca_arm64",
                  "product_id": "openshift-logging/kibana6-rhel8@sha256:3edcb9e5f595f43560c2d1a9cd643ba3a47052d64d02ffb239aa514444c7ffca_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kibana6-rhel8@sha256:3edcb9e5f595f43560c2d1a9cd643ba3a47052d64d02ffb239aa514444c7ffca?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/kibana6-rhel8\u0026tag=v6.8.1-479"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/kibana6-rhel8@sha256:11bfe43b2b6372dfedee47ef10ec0ec67bb7070265f579dd512a36e2ff691ff6_s390x as a component of RHOL 5.8 for RHEL 8",
          "product_id": "8Base-RHOL-5.8:openshift-logging/kibana6-rhel8@sha256:11bfe43b2b6372dfedee47ef10ec0ec67bb7070265f579dd512a36e2ff691ff6_s390x"
        },
        "product_reference": "openshift-logging/kibana6-rhel8@sha256:11bfe43b2b6372dfedee47ef10ec0ec67bb7070265f579dd512a36e2ff691ff6_s390x",
        "relates_to_product_reference": "8Base-RHOL-5.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/kibana6-rhel8@sha256:3edcb9e5f595f43560c2d1a9cd643ba3a47052d64d02ffb239aa514444c7ffca_arm64 as a component of RHOL 5.8 for RHEL 8",
          "product_id": "8Base-RHOL-5.8:openshift-logging/kibana6-rhel8@sha256:3edcb9e5f595f43560c2d1a9cd643ba3a47052d64d02ffb239aa514444c7ffca_arm64"
        },
        "product_reference": "openshift-logging/kibana6-rhel8@sha256:3edcb9e5f595f43560c2d1a9cd643ba3a47052d64d02ffb239aa514444c7ffca_arm64",
        "relates_to_product_reference": "8Base-RHOL-5.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/kibana6-rhel8@sha256:571d43bc602450e0883ec5aa3e7d44a00413be545ab4c0a67db48cd7c1e77b3b_ppc64le as a component of RHOL 5.8 for RHEL 8",
          "product_id": "8Base-RHOL-5.8:openshift-logging/kibana6-rhel8@sha256:571d43bc602450e0883ec5aa3e7d44a00413be545ab4c0a67db48cd7c1e77b3b_ppc64le"
        },
        "product_reference": "openshift-logging/kibana6-rhel8@sha256:571d43bc602450e0883ec5aa3e7d44a00413be545ab4c0a67db48cd7c1e77b3b_ppc64le",
        "relates_to_product_reference": "8Base-RHOL-5.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/kibana6-rhel8@sha256:fff31521cd7e8533be31f39eda05d47fb8986fbeb144819cec3761e3b1e1ba32_amd64 as a component of RHOL 5.8 for RHEL 8",
          "product_id": "8Base-RHOL-5.8:openshift-logging/kibana6-rhel8@sha256:fff31521cd7e8533be31f39eda05d47fb8986fbeb144819cec3761e3b1e1ba32_amd64"
        },
        "product_reference": "openshift-logging/kibana6-rhel8@sha256:fff31521cd7e8533be31f39eda05d47fb8986fbeb144819cec3761e3b1e1ba32_amd64",
        "relates_to_product_reference": "8Base-RHOL-5.8"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2020-11023",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2020-06-23T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1850004"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in jQuery. HTML containing \\\u003coption\\\u003e elements from untrusted sources are passed, even after sanitizing, to one of jQuery\u0027s DOM manipulation methods, which may execute untrusted code. The highest threat from this vulnerability is to data confidentiality and integrity.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jquery: Untrusted code execution via \u003coption\u003e tag in HTML passed to DOM manipulation methods",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Enterprise Linux versions 6, 7, and 8 ship a vulnerable version of JQuery in the `pcs` component. As PCS does not accept untrusted input, the vulnerable code cannot be controlled by an attacker.\n\nMultiple Red Hat offerings use doxygen to build documentation. During this process an affected jquery.js file can be included in the resulting package. The \u0027gcc\u0027 and \u0027tbb\u0027 packages were potentially vulnerable via this method.\n\nOpenShift Container Platform 4 is not affected because even though it uses the \u0027gcc\u0027 component, vulnerable code is limited within the libstdc++-docs rpm package, which is not shipped.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHOL-5.8:openshift-logging/kibana6-rhel8@sha256:11bfe43b2b6372dfedee47ef10ec0ec67bb7070265f579dd512a36e2ff691ff6_s390x",
          "8Base-RHOL-5.8:openshift-logging/kibana6-rhel8@sha256:3edcb9e5f595f43560c2d1a9cd643ba3a47052d64d02ffb239aa514444c7ffca_arm64",
          "8Base-RHOL-5.8:openshift-logging/kibana6-rhel8@sha256:571d43bc602450e0883ec5aa3e7d44a00413be545ab4c0a67db48cd7c1e77b3b_ppc64le",
          "8Base-RHOL-5.8:openshift-logging/kibana6-rhel8@sha256:fff31521cd7e8533be31f39eda05d47fb8986fbeb144819cec3761e3b1e1ba32_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2020-11023"
        },
        {
          "category": "external",
          "summary": "RHBZ#1850004",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1850004"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2020-11023",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-11023"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-11023",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11023"
        },
        {
          "category": "external",
          "summary": "https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/",
          "url": "https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/"
        },
        {
          "category": "external",
          "summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
          "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
        }
      ],
      "release_date": "2020-04-29T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-03-05T13:38:18+00:00",
          "details": "For OpenShift Container Platform 4.13 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.openshift.com/container-platform/4.13/release_notes/ocp-4-13-release-notes.html\n\nFor Red Hat OpenShift Logging 5.8, see the following instructions to apply this update:\n\nhttps://docs.openshift.com/container-platform/4.13/logging/cluster-logging-upgrading.html",
          "product_ids": [
            "8Base-RHOL-5.8:openshift-logging/kibana6-rhel8@sha256:11bfe43b2b6372dfedee47ef10ec0ec67bb7070265f579dd512a36e2ff691ff6_s390x",
            "8Base-RHOL-5.8:openshift-logging/kibana6-rhel8@sha256:3edcb9e5f595f43560c2d1a9cd643ba3a47052d64d02ffb239aa514444c7ffca_arm64",
            "8Base-RHOL-5.8:openshift-logging/kibana6-rhel8@sha256:571d43bc602450e0883ec5aa3e7d44a00413be545ab4c0a67db48cd7c1e77b3b_ppc64le",
            "8Base-RHOL-5.8:openshift-logging/kibana6-rhel8@sha256:fff31521cd7e8533be31f39eda05d47fb8986fbeb144819cec3761e3b1e1ba32_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:1983"
        },
        {
          "category": "workaround",
          "details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
          "product_ids": [
            "8Base-RHOL-5.8:openshift-logging/kibana6-rhel8@sha256:11bfe43b2b6372dfedee47ef10ec0ec67bb7070265f579dd512a36e2ff691ff6_s390x",
            "8Base-RHOL-5.8:openshift-logging/kibana6-rhel8@sha256:3edcb9e5f595f43560c2d1a9cd643ba3a47052d64d02ffb239aa514444c7ffca_arm64",
            "8Base-RHOL-5.8:openshift-logging/kibana6-rhel8@sha256:571d43bc602450e0883ec5aa3e7d44a00413be545ab4c0a67db48cd7c1e77b3b_ppc64le",
            "8Base-RHOL-5.8:openshift-logging/kibana6-rhel8@sha256:fff31521cd7e8533be31f39eda05d47fb8986fbeb144819cec3761e3b1e1ba32_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "8Base-RHOL-5.8:openshift-logging/kibana6-rhel8@sha256:11bfe43b2b6372dfedee47ef10ec0ec67bb7070265f579dd512a36e2ff691ff6_s390x",
            "8Base-RHOL-5.8:openshift-logging/kibana6-rhel8@sha256:3edcb9e5f595f43560c2d1a9cd643ba3a47052d64d02ffb239aa514444c7ffca_arm64",
            "8Base-RHOL-5.8:openshift-logging/kibana6-rhel8@sha256:571d43bc602450e0883ec5aa3e7d44a00413be545ab4c0a67db48cd7c1e77b3b_ppc64le",
            "8Base-RHOL-5.8:openshift-logging/kibana6-rhel8@sha256:fff31521cd7e8533be31f39eda05d47fb8986fbeb144819cec3761e3b1e1ba32_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "exploit_status",
          "date": "2025-01-23T00:00:00+00:00",
          "details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
        },
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "jquery: Untrusted code execution via \u003coption\u003e tag in HTML passed to DOM manipulation methods"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.