{"id":"CVE-2020-26298","aliases":["DEBIAN-CVE-2020-26298","DLA-2526-1","DSA-4831-1","EUVD-2021-0511","GHSA-q3wr-qw3g-3p4h","OESA-2021-1175","SUSE-SU-2021:3728-1","SUSE-SU-2021:3729-1"],"status":"published","title":"Injection in Redcarpet","description":"Redcarpet is a Ruby library for Markdown processing. In Redcarpet before version 3.5.1, there is an injection vulnerability which can enable a cross-site scripting attack. In affected versions no HTML escaping was being performed when processing quotes. This applies even when the `:escape_html` option was being used. This is fixed in version 3.5.1 by the referenced commit.","severity":{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.01589,"percentile":0.7599,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-74","CWE-79"],"published":"2021-01-11T00:00:00Z","modified":"2026-10-26T12:00:10Z","fixes":[{"ecosystem":"RubyGems","package":"redcarpet","fixed_in":["3.5.1"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"ruby-redcarpet","fixed_in":["3.5.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ruby-redcarpet","fixed_in":["3.5.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ruby-redcarpet","fixed_in":["3.5.1-1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"ruby-redcarpet","fixed_in":["3.3.4-2+deb9u1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"ruby-redcarpet","fixed_in":["3.4.0-4+deb10u1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"rubygem-redcarpet","fixed_in":["3.5.1-1.oe1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"redcarpet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ruby-redcarpet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"ruby-redcarpet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ruby-redcarpet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"ruby-redcarpet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.4-2+deb9u1"}]}],"versions":["3.3.4-2"]},{"source":"osv","ecosystem":"Debian:10","package":"ruby-redcarpet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0-4+deb10u1"}]}],"versions":["3.4.0-4"]},{"source":"osv","ecosystem":"RubyGems","package":"redcarpet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1"}]}],"versions":["1.0.0","1.0.1","1.1.0","1.1.1","1.10.0","1.10.1","1.11.0","1.11.1","1.11.2","1.11.3","1.11.4","1.12.0","1.12.1","1.12.2","1.13.0","1.13.1","1.13.2","1.14.0","1.14.1","1.14.2","1.15.0","1.15.1","1.15.2","1.16.0","1.17.0","1.17.1","1.17.2","1.2.0","1.2.1","1.2.2","1.3.0","1.3.1","1.3.2","1.3.3","1.5.0","1.5.1","1.5.2","1.5.3","1.6.0","1.7.0","1.7.1","1.8.0","1.8.1","1.8.2","1.9.0","2.0.0","2.0.0b","2.0.0b3","2.0.0b4","2.0.0b5","2.0.1","2.1.0","2.1.1","2.2.0","2.2.1","2.2.2","2.3.0","3.0.0","3.1.0","3.1.1","3.1.2","3.2.0","3.2.1","3.2.2","3.2.3","3.3.0","3.3.1","3.3.2","3.3.3","3.3.4","3.4.0","3.5.0"]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"rubygem-redcarpet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-1.oe1"}]}]},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"ardana-ansible","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0+git.1632499354.a56668f-3.82.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"ardana-monasca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0+git.1627997000.6c3bc04-3.30.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"documentation-hpe-helion-openstack-installation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20210806-1.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"documentation-hpe-helion-openstack-operations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20210806-1.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"documentation-hpe-helion-openstack-opsconsole","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20210806-1.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"documentation-hpe-helion-openstack-planning","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20210806-1.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"documentation-hpe-helion-openstack-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20210806-1.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"documentation-hpe-helion-openstack-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20210806-1.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"openstack-ec2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.1~dev12-4.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"openstack-heat-templates","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.0+git.1628179051.7d761bf-3.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.29-3.28.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"python-monasca-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1~dev4-4.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"venv-openstack-heat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.8~dev22-12.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"venv-openstack-horizon-hpe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.5~dev6-14.38.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"venv-openstack-monasca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2~dev1-11.30.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"ardana-ansible","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0+git.1632499354.a56668f-3.82.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"ardana-monasca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0+git.1627997000.6c3bc04-3.30.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"documentation-suse-openstack-cloud-installation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20210806-1.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"documentation-suse-openstack-cloud-operations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20210806-1.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"documentation-suse-openstack-cloud-opsconsole","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20210806-1.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"documentation-suse-openstack-cloud-planning","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20210806-1.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"documentation-suse-openstack-cloud-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20210806-1.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"documentation-suse-openstack-cloud-supplement","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20210806-1.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"documentation-suse-openstack-cloud-upstream-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20210806-1.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"documentation-suse-openstack-cloud-upstream-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20210806-1.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"documentation-suse-openstack-cloud-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20210806-1.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"openstack-ec2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.1~dev12-4.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"openstack-heat-templates","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.0+git.1628179051.7d761bf-3.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.29-3.28.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"python-monasca-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1~dev4-4.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"venv-openstack-heat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.8~dev22-12.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"venv-openstack-horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.5~dev6-14.38.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"venv-openstack-monasca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2~dev1-11.30.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"documentation-suse-openstack-cloud-deployment","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20210806-1.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"documentation-suse-openstack-cloud-supplement","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20210806-1.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"documentation-suse-openstack-cloud-upstream-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20210806-1.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"documentation-suse-openstack-cloud-upstream-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20210806-1.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"openstack-ec2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.1~dev12-4.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"openstack-heat-templates","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.0+git.1628179051.7d761bf-3.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.29-3.28.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"python-monasca-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1~dev4-4.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"rubygem-puma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.16.0-3.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"rubygem-redcarpet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"ardana-ansible","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0+git.1628097238.f6cbb0e-3.29.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"ardana-monasca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0+git.1627995376.30bdf85-3.25.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"influxdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.8-4.6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"kibana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.6-4.12.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-cinder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.10~dev23-3.31.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-ec2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.1~dev6-3.3.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-heat-gbp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.1~dev4-3.6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-heat-templates","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.0+git.1628179051.7d761bff-3.12.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-horizon-plugin-gbp-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.1~dev5-3.6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.1~dev7-3.25.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-neutron-gbp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.0.1~dev19-3.28.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.3.1~dev91-3.40.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"python-eventlet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.0-8.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.1~dev24-3.25.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-cinder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.10~dev23-3.28.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-designate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.2~dev2-3.25.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-glance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.0.1~dev30-3.23.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-heat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.4~dev4-3.25.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.1.1~dev11-4.29.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-ironic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.1.5~dev17-4.23.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.1~dev7-3.26.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-magnum","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.1~dev1-4.25.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-manila","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.2~dev60-3.31.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-monasca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1~dev10-3.23.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-monasca-ceilometer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.2~dev3-3.25.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.8~dev164-6.29.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.3.1~dev91-3.29.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-octavia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3~dev7-4.25.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-sahara","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.2~dev15-3.25.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.2~dev48-2.20.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"crowbar-openstack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0+git.1630614261.26948f746-3.37.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"influxdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.8-4.6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"kibana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.6-4.12.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-cinder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.10~dev23-3.31.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-ec2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.1~dev6-3.3.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-heat-gbp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.1~dev4-3.6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-heat-templates","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.0+git.1628179051.7d761bff-3.12.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-horizon-plugin-gbp-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.1~dev5-3.6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.1~dev7-3.25.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-neutron-gbp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.0.1~dev19-3.28.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.3.1~dev91-3.40.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-eventlet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.0-8.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"rubygem-puma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.16.0-4.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"rubygem-redcarpet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-4.3.1"}]}],"bundled":4}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"redcarpet_project","product":"redcarpet"},{"vendor":"vmg","product":"redcarpet"}],"references":[{"url":"https://github.com/advisories/GHSA-q3wr-qw3g-3p4h","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://github.com/vmg/redcarpet/commit/a699c82292b17c8e6a62e1914d5eccc252272793","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://rubygems.org/gems/redcarpet","tags":["x_transferred","Product","Third Party Advisory","advisory","web"]},{"url":"https://github.com/vmg/redcarpet/blob/master/CHANGELOG.md#version-351-security","tags":["x_transferred","Release Notes","Third Party Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/01/msg00014.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://www.debian.org/security/2021/dsa-4831","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNO4ZZUPGAEUXKQL4G2HRIH7CUZKPCT6/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFMYDIONVWATY7EB6EARDVXT47AYCRNM/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PXNNWHHAPREDM3XJDACYRTK7DBMUONBI/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-26298","tags":["advisory"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/redcarpet/CVE-2020-26298.yml","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BFMYDIONVWATY7EB6EARDVXT47AYCRNM/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNO4ZZUPGAEUXKQL4G2HRIH7CUZKPCT6/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PXNNWHHAPREDM3XJDACYRTK7DBMUONBI/"},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-26298","tags":["advisory"]},{"url":"https://github.com/vmg/redcarpet","tags":["package"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BFMYDIONVWATY7EB6EARDVXT47AYCRNM","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNO4ZZUPGAEUXKQL4G2HRIH7CUZKPCT6","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PXNNWHHAPREDM3XJDACYRTK7DBMUONBI","tags":["web"]},{"url":"https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1175","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20213728-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1180837","tags":["report"]},{"url":"https://bugzilla.suse.com/1191681","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26298","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41136","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20213729-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1185836","tags":["report"]},{"url":"https://bugzilla.suse.com/1186868","tags":["report"]},{"url":"https://bugzilla.suse.com/1189052","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21419","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22141","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-26298","title":"Injection in Redcarpet","description":"Redcarpet is a Ruby library for Markdown processing. In Redcarpet before version 3.5.1, there is an injection vulnerability which can enable a cross-site scripting attack. In affected versions no HTML escaping was being performed when processing quotes. This applies even when the `:escape_html` option was being used. This is fixed in version 3.5.1 by the referenced commit.","status":"published","published":"2021-01-11T00:00:00Z","modified":"2025-02-13T16:27:42.195Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-74","CWE-79"],"updated_at":"2026-11-02T14:35:46.129376Z"}],"euvd":[{"id":"EUVD-2021-0511","description":"Redcarpet is a Ruby library for Markdown processing. In Redcarpet before version 3.5.1, there is an injection vulnerability which can enable a cross-site scripting attack. In affected versions no HTML escaping was being performed when processing quotes. This applies even when the `:escape_html` option was being used. This is fixed in version 3.5.1 by the referenced commit.","status":"published","published":"2021-01-11T00:00:00Z","modified":"2025-02-13T16:27:42Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-03T00:03:53.290549Z"}],"ghsa":[{"id":"GHSA-q3wr-qw3g-3p4h","title":"Injection/XSS in Redcarpet","description":"Redcarpet is a Ruby library for Markdown processing. In Redcarpet before version 3.5.1, there is an injection vulnerability which can enable a cross-site scripting attack. In affected versions no HTML escaping was being performed when processing quotes. This applies even when the `:escape_html` option was being used.  This is fixed in version 3.5.1 by the referenced commit.","status":"published","published":"2021-01-11T19:06:10Z","modified":"2023-05-09T16:25:06Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-74","CWE-79"],"updated_at":"2026-11-02T14:36:52.310293Z"}],"nvd":[{"id":"CVE-2020-26298","description":"Redcarpet is a Ruby library for Markdown processing. In Redcarpet before version 3.5.1, there is an injection vulnerability which can enable a cross-site scripting attack. In affected versions no HTML escaping was being performed when processing quotes. This applies even when the `:escape_html` option was being used. This is fixed in version 3.5.1 by the referenced commit.","status":"published","published":"2021-01-11T19:15:13.133Z","modified":"2026-06-17T03:08:01.6Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-74","CWE-79"],"updated_at":"2026-11-02T14:06:28.892872Z"}],"osv":[{"id":"CVE-2020-26298","description":"Redcarpet is a Ruby library for Markdown processing. In Redcarpet before version 3.5.1, there is an injection vulnerability which can enable a cross-site scripting attack. In affected versions no HTML escaping was being performed when processing quotes. This applies even when the `:escape_html` option was being used. This is fixed in version 3.5.1 by the referenced commit.","status":"published","published":"2021-01-11T19:15:13.133Z","modified":"2026-10-20T14:05:17.533346145Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:16.248747Z"},{"id":"DEBIAN-CVE-2020-26298","description":"Redcarpet is a Ruby library for Markdown processing. In Redcarpet before version 3.5.1, there is an injection vulnerability which can enable a cross-site scripting attack. In affected versions no HTML escaping was being performed when processing quotes. This applies even when the `:escape_html` option was being used. This is fixed in version 3.5.1 by the referenced commit.","status":"published","published":"2021-01-11T19:15:13.133Z","modified":"2026-10-26T12:00:10.742660263Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:33.729655Z"},{"id":"GHSA-q3wr-qw3g-3p4h","title":"Injection/XSS in Redcarpet","description":"Redcarpet is a Ruby library for Markdown processing. In Redcarpet before version 3.5.1, there is an injection vulnerability which can enable a cross-site scripting attack. In affected versions no HTML escaping was being performed when processing quotes. This applies even when the `:escape_html` option was being used.  This is fixed in version 3.5.1 by the referenced commit.","status":"published","published":"2021-01-11T19:06:10Z","modified":"2026-07-08T05:59:45.900047476Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-74","CWE-79"],"updated_at":"2026-11-02T15:46:54.055966Z"},{"id":"OESA-2021-1175","title":"rubygem-redcarpet security update","description":"A fast, safe and extensible Markdown to (X)HTML parser.\r\n\r\nSecurity Fix(es):\r\n\r\nRedcarpet is a Ruby library for Markdown processing. In Redcarpet before version 3.5.1, there is an injection vulnerability which can enable a cross-site scripting attack. In affected versions no HTML escaping was being performed when processing quotes. This applies even when the `:escape_html` option was being used. This is fixed in version 3.5.1 by the referenced commit.(CVE-2020-26298)","status":"published","published":"2021-05-06T11:04:24Z","modified":"2026-08-18T01:15:34.105066013Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"DLA-2526-1","title":"ruby-redcarpet - security update","status":"published","published":"2021-01-15T00:00:00Z","modified":"2026-03-09T01:21:26.591698Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"DSA-4831-1","title":"ruby-redcarpet - security update","status":"published","published":"2021-01-15T00:00:00Z","modified":"2026-03-09T02:11:13.351335Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"SUSE-SU-2021:3728-1","title":"Security update for ardana-ansible, ardana-monasca, documentation-suse-openstack-cloud, openstack-ec2-api, openstack-heat-templates, python-Django, python-monasca-common, rubygem-redcarpet, rubygem-puma","description":"This update for ardana-ansible, ardana-monasca, documentation-suse-openstack-cloud, openstack-ec2-api, openstack-heat-templates, python-Django, python-monasca-common, rubygem-redcarpet, rubygem-puma contains the following fixes:\n\nSecurity fixes included in this update:\n\nrubygem-redcarpet:\nCVE-2020-26298: Fixed XSS via HTML escaping when processing quotes. (bsc#1180837)\n\nrubygem-puma:\nCVE-2021-41136: Fixed build of the Java state machine for parsing HTTP. (bsc#1191681)\n\nNon-security fixes included in this update:\n\nChanges in ardana-ansible:\n  * Patch service.py to skip blank lines.\n\nChanges in ardana-monasca:\n  * Use specific TLS versions for monasca-thresh DB connections. (SOC-11543)\n\nChanges in documentation-suse-openstack-cloud:\n  * CI: only run on DocBook/AsciiDoc paths, make upload fails nonfatal\n  * DC files: Update to 2021 stylesheets (#1327)\n  * CI: Use GitHub Actions\n\nChanges in openstack-ec2-api:\n  * Remove jobs corresponds to obselete featuresets\n  * OpenDev Migration Patch\n\nChanges in openstack-heat-templates:\n  * [ussuri][goal] Update contributor documentation\n\nChanges in python-Django:\n- Add missing dependency for CVE-2021-31542\n\nChanges in python-monasca-common:\n- Remove renderspec source service.\n- Retry publish once on failures. (SOC-11543)\n  \n  ","status":"published","published":"2021-11-19T12:37:40Z","modified":"2026-02-04T03:00:08.222838Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2021:3729-1","title":"Security update for ardana-ansible, ardana-monasca, crowbar-openstack, influxdb, kibana, openstack-cinder, openstack-ec2-api, openstack-heat-gbp, openstack-heat-templates, openstack-horizon-plugin-gbp-ui, openstack-keystone, openstack-neutron-gbp, openstack-nova, python-eventlet, rubygem-redcarpet, rubygem-puma","description":"This update for ardana-ansible, ardana-monasca, crowbar-openstack, influxdb, kibana, openstack-cinder, openstack-ec2-api, openstack-heat-gbp, openstack-heat-templates, openstack-horizon-plugin-gbp-ui, openstack-keystone, openstack-neutron-gbp, openstack-nova, python-eventlet, rubygem-redcarpet, rubygem-puma contains the following fixes:\n\nSecurity fixes included in this update:\n\nkibana:\nCVE-2021-22141: Fixed URL redirection flaw (bsc#1186868).\n\npython-eventlet:\nCVE-2021-21419: Fixed improper handling of highly compressed data and memory allocation with excessive size value. (bsc#1185836)\n\nrubygem-redcarpet:\nCVE-2020-26298: Fixed XSS via HTML escaping when processing quotes. (bsc#1180837)\n\nrubygem-puma:\nCVE-2021-41136: Fixes build of the Java state machine for parsing HTTP. (bsc#1191681)\n\nNon-security fixes included in this update:\n\nChanges in ardana-ansible:\n  * Patch service.py to skip blank lines.\n\nChanges in ardana-monasca:\n  * Use specific TLS versions for monasca-thresh DB connections. (SOC-11543)\n\nChanges in crowbar-openstack:\n  * keystone wakeup: get new session on any error. (bsc#1189052)\n\nChanges in influxdb:\n- Set GO111MODULE=auto to fix build with go1.16 and later where default is GO111MODULE=on\n\nCanges in kibana:\n  - Fix an open redirect flaw. (CVE-2021-22141, bsc#1186868)\n\nChanges in openstack-cinder:\n  * Fix typo in Dell EMC Unity driver documentation.\n  * Drop lower-constraints job.\n  * [stable-only] Cap bandit to v1.6.2 and fix constraints.\n\nChanges in openstack-ec2-api:\n  * Remove jobs corresponds to obselete featuresets.\n  * OpenDev Migration Patch.\n\nChanges in openstack-heat-gbp:\n  * Add support for Wallaby.\n  * Fix upstream gate.\n\nChanges in openstack-heat-templates:\n  * [ussuri][goal] Update contributor documentation.\n  * Fix zuul config for heat-templates-check.\n  * Remove testr.\n\nChanges in openstack-horizon-plugin-gbp-ui:\n  * Add support for Wallaby.\n  * Fix upstream gate.\n\nChanges in openstack-keystone:\n  * Retry update\\_user when sqlalchemy raises StaleDataErrors.\n  * Pin keystone-tempest-plugin for py27 compatibility.\n\nChanges in openstack-neutron-gbp:\n  * Fix update router API.\n  * Fix HA IP DB migration.\n  * Revert 'Fix HA IP DB migration'.\n  * Fix HA IP DB migration.\n  * Add network\\_id column to apic\\_ml2\\_ha\\_ipaddress\\_to\\_port\\_owner table.\n  * Use custom converter for extra attributes.\n  * Validate network before creating or updating router.\n  * Fix Data Migration query for HA IP table.\n  * System security grp:Add system sg in port sg list.\n  * Add vrf column to apic\\_ml2\\_ha\\_ipaddress\\_to\\_port\\_owner table.\n  * [apic\\_aim]: Fix HA IP UTs.\n  * Fixing the exception msg for IPAddressGenerationFailure.\n  * Enhancement regarding router/instance attachment to an external network floating ip and snat subnets.\n  * Setting legacy-group-based-policy-dsvm-aim to non-voting gate.\n  * Add support for Wallaby.\n  * Bug fixes for gbp-validate.\n  * [apic\\_aim]: Filter endpoint details.\n  * Bugfix: Policy Enforcement Pref.\n  * Fix unit-tests for tenant-scope validation.\n  * [AIM] Add Policy Enforcement Pref to network extension.\n\nChanges in openstack-nova:\n  * [neutron] Get only ID and name of the SGs from Neutron.\n  * Remove allocations before setting vm\\_status to SHELVED\\_OFFLOADED.\n  * libvirt:driver:Disallow AIO=native when 'O\\_DIRECT' is not available.\n  * Update pci stat pools based on PCI device changes.\n  * Use subqueryload() instead of joinedload() for (system\\_)metadata.\n\nChanges in python-eventlet:\n  Websocket: Limit maximum uncompressed frame length to 8MiB. (bsc#1185836 CVE-2021-21419)\n  ","status":"published","published":"2021-11-19T12:39:54Z","modified":"2026-02-04T04:40:14.481672Z","updated_at":"2026-11-02T15:53:49.605187Z"}]}}