CVE-2021-20066
Description
A flaw was found in jsdom. JSDom improperly allows the loading of local resources, which allows for local files to be manipulated by a malicious web page when script execution is enabled.
Statement
For an application which includes jsdom to be vulnerable to this CVE, it must at least enable the loading of resources using something similar to: new JSDOM(html, {resources: "usable"}, where html is un-trusted input. Furthermore, scripts can be executed by extending the options similar to: new JSDOM(html, {resources: "usable", runScripts: "dangerously"}. [1]
OpenShift Container Platform (OCP) and OpenShift ServiceMesh (OSSM) both include components that package a vulnerable version of jsdom. However, none of the components directly enable the loading of resources via resources: "usable" and most components only include jsdom for use in tests. Hence for OCP and OSSM the affects are rated to have a Low impact and are wontfix at this time and might be fixed in a future release.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.6 | 5.6 | N/A |
| Attack Vector | Network | Network | N/A |
| Attack Complexity | High | High | N/A |
| Privileges Required | None | None | N/A |
| User Interaction | None | None | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | Low | Low | N/A |
| Integrity Impact | Low | Low | N/A |
| Availability Impact | Low | Low | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
NVD: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
