CVE-2017-18635
Fixed in a distro release EPSS 5%
An XSS vulnerability was discovered in noVNC before 0.6.2 in which the remote VNC server could inject arbitrary HTML into the noVNC web page via the messages propagated to the status field, such as the VNC server name.
Products: novnc, debian_linux, canonical ubuntu_linux, redhat openstack
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | @novnc/novnc | 0.6.2 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | novnc | 1:1.0.0-1 |
| Debian 13 | novnc | 1:1.0.0-1 |
| Debian 14 | novnc | 1:1.0.0-1 |
| Debian 8 | novnc | 1:0.4+dfsg+1+20131010+gitf68af8af3d-4+deb8u1 |
| Debian 9 | novnc | 1:0.4+dfsg+1+20131010+gitf68af8af3d-6+deb9u1 |
| Red Hat openstack 13 | novnc | 0:1.1.0-2.el7ost |
| Red Hat rhev manager 4.4 el8 | novnc | 0:1.1.0-1.el8ost |
| Red Hat rhev manager 4.4 el8 | ovirt-engine | 0:4.4.1.8-0.7.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-api-explorer | 0:0.0.6-1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-backend | 0:4.4.1.8-0.7.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-dbscripts | 0:4.4.1.8-0.7.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-health-check-bundler | 0:4.4.1.8-0.7.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-restapi | 0:4.4.1.8-0.7.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-setup | 0:4.4.1.8-0.7.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-setup-base | 0:4.4.1.8-0.7.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-setup-plugin-cinderlib | 0:4.4.1.8-0.7.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-setup-plugin-imageio | 0:4.4.1.8-0.7.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-setup-plugin-ovirt-engine | 0:4.4.1.8-0.7.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-setup-plugin-ovirt-engine-common | 0:4.4.1.8-0.7.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-setup-plugin-vmconsole-proxy-helper | 0:4.4.1.8-0.7.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-setup-plugin-websocket-proxy | 0:4.4.1.8-0.7.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-tools | 0:4.4.1.8-0.7.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-tools-backup | 0:4.4.1.8-0.7.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-ui-extensions | 0:1.2.2-1.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-vmconsole-proxy-helper | 0:4.4.1.8-0.7.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-webadmin-portal | 0:4.4.1.8-0.7.el8ev |
| Red Hat rhev manager 4.4 el8 | ovirt-engine-websocket-proxy | 0:4.4.1.8-0.7.el8ev |
| Red Hat rhev manager 4.4 el8 | python3-ovirt-engine-lib | 0:4.4.1.8-0.7.el8ev |
| Red Hat rhev manager 4.4 el8 | rhvm | 0:4.4.1.8-0.7.el8ev |
| Red Hat rhev manager 4.4 el8 | rhvm-dependencies | 0:4.4.0-1.el8ev |
| Ubuntu 16.04 LTS | novnc | 1:0.4+dfsg+1+20131010+gitf68af8af3d-4+deb8u1build0.16.04.1 |
| Ubuntu 18.04 LTS | novnc | no fix |