{"id":"CVE-2022-32209","aliases":["DEBIAN-CVE-2022-32209","DLA-3227-1","DLA-3902-1","EUVD-2022-6111","GHSA-pg8v-g4xq-hww9","RHSA-2022:8506","RLSA-2022:8506","SUSE-SU-2022:2870-1","SUSE-SU-2022:2885-1","UBUNTU-CVE-2022-32209","openSUSE-SU-2024:12145-1","openSUSE-SU-2024:13137-1","openSUSE-SU-2024:14175-1","openSUSE-SU-2025:15125-1","openSUSE-SU-2026:10361-1"],"status":"published","title":"Rails::Html::Sanitizer vulnerable to Cross-site Scripting","description":"# Possible XSS Vulnerability in Rails::Html::SanitizerThere is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer.This vulnerability has been assigned the CVE identifier CVE-2022-32209.Versions Affected: ALLNot affected: NONEFixed Versions: v1.4.3## ImpactA possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags to allow both `select` and `style` elements.Code is only impacted if allowed tags are being overridden. This may be done via application configuration:```ruby# In config/application.rbconfig.action_view.sanitized_allowed_tags = [\"select\", \"style\"]```see https://guides.rubyonrails.org/configuring.html#configuring-action-viewOr it may be done with a `:tags` option to the Action View helper `sanitize`:```\u003c%= sanitize @comment.body, tags: [\"select\", \"style\"] %\u003e```see https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html#method-i-sanitizeOr it may be done with Rails::Html::SafeListSanitizer directly:```ruby# class-level optionRails::Html::SafeListSanitizer.allowed_tags = [\"select\", \"style\"]```or```ruby# instance-level optionRails::Html::SafeListSanitizer.new.sanitize(@article.body, tags: [\"select\", \"style\"])```All users overriding the allowed tags by any of the above mechanisms to include both \"select\" and \"style\" should either upgrade or use one of the workarounds immediately.## ReleasesThe FIXED releases are available at the normal locations.## WorkaroundsRemove either `select` or `style` from the overridden allowed tags.## CreditsThis vulnerability was responsibly reported by [windshock](https://hackerone.com/windshock?type=user).","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.26501,"percentile":0.98027,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2022-06-24T00:00:00Z","modified":"2026-11-03T06:02:32Z","fixes":[{"ecosystem":"RubyGems","package":"rails-html-sanitizer","fixed_in":["1.4.3"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"ruby-rails-html-sanitizer","fixed_in":["1.4.3-0.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ruby-rails-html-sanitizer","fixed_in":["1.4.3-0.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ruby-rails-html-sanitizer","fixed_in":["1.4.3-0.1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"ruby-rails-html-sanitizer","fixed_in":["1.0.4-1+deb10u1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Availability Extension 15","package":"rubygem-rails-html-sanitizer","fixed_in":["1.0.4-150000.4.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP1","package":"rubygem-rails-html-sanitizer","fixed_in":["1.0.4-150000.4.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP2","package":"rubygem-rails-html-sanitizer","fixed_in":["1.0.4-150000.4.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP3","package":"rubygem-rails-html-sanitizer","fixed_in":["1.0.4-150000.4.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP4","package":"rubygem-rails-html-sanitizer","fixed_in":["1.0.4-150000.4.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"rubygem-rails-html-sanitizer","fixed_in":["1.0.4-150000.4.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"rubygem-rails-html-sanitizer","fixed_in":["1.0.4-150000.4.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"rubygem-rails-html-sanitizer","fixed_in":["1.0.3-8.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"rubygem-rails-html-sanitizer","fixed_in":["1.0.3-8.11.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"rails-html-sanitizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ruby-rails-html-sanitizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3-0.1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"ruby-rails-html-sanitizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3-0.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ruby-rails-html-sanitizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3-0.1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"ruby-rails-html-sanitizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-1+deb10u1"}]}],"versions":["1.0.4-1"]},{"source":"osv","ecosystem":"Debian:11","package":"ruby-rails-html-sanitizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-1+deb11u1"}]}],"versions":["1.3.0-1"],"bundled":5},{"source":"osv","ecosystem":"RubyGems","package":"rails-html-sanitizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.1.0","1.2.0","1.3.0","1.4.0","1.4.1","1.4.2"]},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"candlepin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.15-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"candlepin-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.15-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.12::el8","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.14-2.el8pc"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.12::el8","package":"python39-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.14-2.el8pc"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.14-2.el8pc"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"python39-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.14-2.el8pc"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.12::el8","package":"rubygem-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.8-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.12::el8","package":"rubygem-nokogiri-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.8-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.12::el8","package":"rubygem-nokogiri-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.8-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"rubygem-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.8-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"rubygem-nokogiri-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.8-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"rubygem-nokogiri-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.8-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"rubygem-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.11.0-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.12::el8","package":"rubygem-sinatra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.0-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"rubygem-sinatra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.0-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"rubygem-rails-html-sanitizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.3-2.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.12::el8","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.12::el8","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.12::el8","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.12::el8","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"foreman-dynflow-sidekiq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"foreman-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"foreman-gce","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"foreman-journald","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"foreman-libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"foreman-openstack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"foreman-ovirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"foreman-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"foreman-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"foreman-telemetry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:satellite:6.12::el8","package":"foreman-vmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.0.17-1.el8sat"}]}],"bundled":10},{"source":"osv","ecosystem":"Rocky Linux:8","package":"libdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.28-42.el8_4"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15","package":"rubygem-rails-html-sanitizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-150000.4.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP1","package":"rubygem-rails-html-sanitizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-150000.4.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP2","package":"rubygem-rails-html-sanitizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-150000.4.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP3","package":"rubygem-rails-html-sanitizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-150000.4.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP4","package":"rubygem-rails-html-sanitizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-150000.4.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"rubygem-rails-html-sanitizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-150000.4.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"rubygem-rails-html-sanitizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-150000.4.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"rubygem-rails-html-sanitizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-8.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"rubygem-rails-html-sanitizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-8.11.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ruby-rails-html-sanitizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.2-1","1.0.3-1","1.0.3-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"ruby-rails-html-sanitizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.3-2","1.0.4-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"ruby-rails-html-sanitizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.4-1","1.3.0-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ruby-rails-html-sanitizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.0-2","1.4.2-1","1.4.2-2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-rails-html-sanitizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3-1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ruby3.2-rubygem-rails-html-sanitizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0-2.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-rails-html-sanitizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0-1.5"}]}],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-rails-html-sanitizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0-1.7"}]}],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-rails-html-sanitizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0-1.9"}]}],"bundled":9}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"rubyonrails","product":"rails_html_sanitizers"}],"references":[{"url":"https://hackerone.com/reports/1530898","tags":["x_transferred","Exploit","Third Party Advisory","web","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AGRLWBEB3S5AU3D4TTROIS7O6QPHDTRH/","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NHDACMCLWE32BZZTSNWQPIFUAD5I6Q47/","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/12/msg00012.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","article","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/09/msg00045.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-32209","tags":["advisory"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rails-html-sanitizer/CVE-2022-32209.yml","tags":["web"]},{"url":"https://groups.google.com/g/rubyonrails-security/c/ce9PhUANQ6s","tags":["web"]},{"url":"https://github.com/rails/rails-html-sanitizer/commit/45a5c10fed3d9aa141594c80afa06d748fa0967d","tags":["web","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AGRLWBEB3S5AU3D4TTROIS7O6QPHDTRH","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NHDACMCLWE32BZZTSNWQPIFUAD5I6Q47","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AGRLWBEB3S5AU3D4TTROIS7O6QPHDTRH","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NHDACMCLWE32BZZTSNWQPIFUAD5I6Q47","tags":["web"]},{"url":"https://github.com/advisories/GHSA-pg8v-g4xq-hww9"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/32xxx/CVE-2022-32209.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-32209","tags":["advisory"]},{"url":"https://github.com/rails/rails-html-sanitizer","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2022:8506","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1309740","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1703496","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1732590","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1775813","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1829468","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1830968","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1834897","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1850393","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1868175","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1868323","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1870816","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1879811","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1884148","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1892218","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1892752","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1894033","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1908841","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1912941","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1925165","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1930577","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1931532","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1931665","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1934210","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1938092","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1940396","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1951542","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1952939","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1959136","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1962253","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1964080","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1970132","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1970623","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1971747","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1973329","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1974180","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1981444","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1982698","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1982745","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1984400","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1989631","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1990119","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1991557","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1994877","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1994945","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1998477","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2000613","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2001517","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2001552","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2004133","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2004135","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2006974","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2007117","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2011312","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2013611","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2015062","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2015757","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2016924","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2022065","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2022649","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2024175","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2024576","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2024968","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2025892","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2025926","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2027947","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2028112","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2033321","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2033381","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2035287","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2036151","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2038989","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2043126","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2043242","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2048547","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2048775","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2049595","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2051648","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2051891","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2052076","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2053842","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2054011","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2054042","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2054786","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2054969","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2055391","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2055416","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2055979","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2056188","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2056702","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2058037","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2059179","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2060651","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2062800","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2064979","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2068454","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2069306","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2069440","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2069634","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2070001","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2070535","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2070732","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2070972","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2072696","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2073305","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2074346","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2075056","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2076843","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2077811","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2077822","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2077824","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2080324","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2080423","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2081096","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2084130","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2085490","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2088303","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2089445","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2089828","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2091044","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2092039","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2093884","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2094019","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2095187","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2095820","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2096429","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2098240","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2099620","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2100578","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2100887","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2101579","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2101882","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2101986","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2102145","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2102456","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2102825","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2102867","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2102896","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2103096","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2103099","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2103102","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2103106","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2103110","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2103129","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2103522","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2104401","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2104498","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2105048","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2105107","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2105144","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2105299","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2105941","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2106000","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2106090","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2106091","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2106092","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2106093","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2106333","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2106659","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2106691","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2106700","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2106885","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2107252","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2107572","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2107577","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2107701","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2108169","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2108611","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2108637","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2108719","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2109254","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2109260","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2109298","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2109421","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2109594","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2109606","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2109810","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2110003","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2110163","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2110222","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2110731","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2110872","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2111038","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2111074","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2111222","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2111373","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2111469","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2111570","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2111571","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2111578","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2111921","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2112015","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2112093","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2112098","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2112436","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2112979","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2113013","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2113905","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2113946","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2113996","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2115229","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2115686","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2115767","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2115775","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2115822","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2115832","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2116123","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2116276","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2116385","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2116871","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2117382","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2117489","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2117522","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2118055","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2118252","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2118356","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2118431","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2118689","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2118694","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2118772","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2118790","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2118950","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2118966","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2119112","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2119117","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2119120","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2119124","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2119190","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2119234","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2119688","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2120148","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2120224","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2120299","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2120327","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2120414","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2120579","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2120632","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2120715","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2120992","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2121238","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2121249","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2121583","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2121689","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2121738","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2121739","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2121954","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2122090","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2122214","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2122764","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2122780","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2122945","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2123352","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2123405","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2124047","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2124051","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2124087","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2124271","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2124568","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2124663","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2124850","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2124851","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2124928","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2125022","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2125244","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2125317","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2125585","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2125669","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2127099","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2127318","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2127934","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2127940","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2128209","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2128422","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2129002","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2131729","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2133468","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2139368","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2139369","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2139371","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_8506.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-37136","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-37136","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-37136","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-grg4-wf29-r9vv","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-37137","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-37137","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-37137","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-22818","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-22818","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22818","tags":["advisory"]},{"url":"https://www.djangoproject.com/weblog/2022/feb/01/security-releases/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-24836","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-24836","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24836","tags":["advisory"]},{"url":"https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-crjr-9rc5-ghw8","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-25648","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-25648","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25648","tags":["advisory"]},{"url":"https://snyk.io/vuln/SNYK-RUBY-GIT-2421270","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-29181","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2088684","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-29181","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-29181","tags":["advisory"]},{"url":"https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-xh29-r2w5-wx8m","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-29970","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-29970","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-29970","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-32209","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-32209","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-34265","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-34265","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-34265","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-6861","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2317450","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-6861","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-6861","tags":["advisory"]},{"url":"https://docs.theforeman.org/3.3/Release_Notes/index-katello.html#_foreman_2","tags":["article"]},{"url":"https://projects.theforeman.org/issues/34328","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2022:8506","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222870-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1201183","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-32209","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222885-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-32209","tags":["report"]},{"url":"https://discuss.rubyonrails.org/t/cve-2022-32209-possible-xss-vulnerability-in-rails-sanitizer/80800","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7578","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7579","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7580","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-3741","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23517","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23518","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23519","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23520","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4QQONV4QKIWHRILZMO26H7FGDPO7KJAF/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-32209","description":"# Possible XSS Vulnerability in Rails::Html::SanitizerThere is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer.This vulnerability has been assigned the CVE identifier CVE-2022-32209.Versions Affected: ALLNot affected: NONEFixed Versions: v1.4.3## ImpactA possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags to allow both `select` and `style` elements.Code is only impacted if allowed tags are being overridden. This may be done via application configuration:```ruby# In config/application.rbconfig.action_view.sanitized_allowed_tags = [\"select\", \"style\"]```see https://guides.rubyonrails.org/configuring.html#configuring-action-viewOr it may be done with a `:tags` option to the Action View helper `sanitize`:```\u003c%= sanitize @comment.body, tags: [\"select\", \"style\"] %\u003e```see https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html#method-i-sanitizeOr it may be done with Rails::Html::SafeListSanitizer directly:```ruby# class-level optionRails::Html::SafeListSanitizer.allowed_tags = [\"select\", \"style\"]```or```ruby# instance-level optionRails::Html::SafeListSanitizer.new.sanitize(@article.body, tags: [\"select\", \"style\"])```All users overriding the allowed tags by any of the above mechanisms to include both \"select\" and \"style\" should either upgrade or use one of the workarounds immediately.## ReleasesThe FIXED releases are available at the normal locations.## WorkaroundsRemove either `select` or `style` from the overridden allowed tags.## CreditsThis vulnerability was responsibly reported by [windshock](https://hackerone.com/windshock?type=user).","status":"published","published":"2022-06-24T00:00:00Z","modified":"2025-11-03T21:46:21.461Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:34:36.917505Z"}],"euvd":[{"id":"EUVD-2022-6111","description":"# Possible XSS Vulnerability in Rails::Html::SanitizerThere is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer.This vulnerability has been assigned the CVE identifier CVE-2022-32209.Versions Affected: ALLNot affected: NONEFixed Versions: v1.4.3## ImpactA possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags to allow both `select` and `style` elements.Code is only impacted if allowed tags are being overridden. This may be done via application configuration:```ruby# In config/application.rbconfig.action_view.sanitized_allowed_tags = [\"select\", \"style\"]```see https://guides.rubyonrails.org/configuring.html#configuring-action-viewOr it may be done with a `:tags` option to the Action View helper `sanitize`:```\u003c%= sanitize @comment.body, tags: [\"select\", \"style\"] %\u003e```see https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html#method-i-sanitizeOr it may be done with Rails::Html::SafeListSanitizer directly:```ruby# class-level optionRails::Html::SafeListSanitizer.allowed_tags = [\"select\", \"style\"]```or```ruby# instance-level optionRails::Html::SafeListSanitizer.new.sanitize(@article.body, tags: [\"select\", \"style\"])```All users overriding the allowed tags by any of the above mechanisms to include both \"select\" and \"style\" should either upgrade or use one of the workarounds immediately.## ReleasesThe FIXED releases are available at the normal locations.## WorkaroundsRemove either `select` or `style` from the overridden allowed tags.## CreditsThis vulnerability was responsibly reported by [windshock](https://hackerone.com/windshock?type=user).","status":"published","published":"2022-06-24T00:00:00Z","modified":"2025-11-03T21:46:21Z","updated_at":"2026-11-02T19:49:31.25882Z"}],"ghsa":[{"id":"GHSA-pg8v-g4xq-hww9","title":"Rails::Html::Sanitizer vulnerable to Cross-site Scripting","description":"Versions of Rails::Html::Sanitizer prior to version 1.4.3 are vulnerable to XSS with certain configurations of Rails::Html::Sanitizer which  allows an attacker to inject content when the application developer has overridden the sanitizer's allowed tags to allow both `select` and `style` elements. Code is only impacted if allowed tags are being overridden. \n\nThis may be done via application configuration: ```ruby# In config/application.rbconfig.action_view.sanitized_allowed_tags = [\"select\", \"style\"]```\n\nsee https://guides.rubyonrails.org/configuring.html#configuring-action-view\n\nOr it may be done with a `:tags` option to the Action View helper `sanitize`: ```\u003c%= sanitize @comment.body, tags: [\"select\", \"style\"] %\u003e``` \n\nsee https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html#method-i-sanitize \n\nIt may also be done with Rails::Html::SafeListSanitizer directly: \n```ruby# class-level optionRails::Html::SafeListSanitizer.allowed_tags = [\"select\", \"style\"]```  or with\n```ruby# instance-level optionRails::Html::SafeListSanitizer.new.sanitize(@article.body, tags: [\"select\", \"style\"])```\n\nAll users overriding the allowed tags by any of the above mechanisms to include both \"select\" and \"style\" are recommended to upgrade immediately. A workaround for this issue can be applied by removing either `select` or `style` from the overridden allowed tags.","status":"published","published":"2022-06-25T00:00:54Z","modified":"2025-11-04T16:39:38Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:39:05.278442Z"}],"nvd":[{"id":"CVE-2022-32209","description":"# Possible XSS Vulnerability in Rails::Html::SanitizerThere is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer.This vulnerability has been assigned the CVE identifier CVE-2022-32209.Versions Affected: ALLNot affected: NONEFixed Versions: v1.4.3## ImpactA possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags to allow both `select` and `style` elements.Code is only impacted if allowed tags are being overridden. This may be done via application configuration:```ruby# In config/application.rbconfig.action_view.sanitized_allowed_tags = [\"select\", \"style\"]```see https://guides.rubyonrails.org/configuring.html#configuring-action-viewOr it may be done with a `:tags` option to the Action View helper `sanitize`:```\u003c%= sanitize @comment.body, tags: [\"select\", \"style\"] %\u003e```see https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html#method-i-sanitizeOr it may be done with Rails::Html::SafeListSanitizer directly:```ruby# class-level optionRails::Html::SafeListSanitizer.allowed_tags = [\"select\", \"style\"]```or```ruby# instance-level optionRails::Html::SafeListSanitizer.new.sanitize(@article.body, tags: [\"select\", \"style\"])```All users overriding the allowed tags by any of the above mechanisms to include both \"select\" and \"style\" should either upgrade or use one of the workarounds immediately.## ReleasesThe FIXED releases are available at the normal locations.## WorkaroundsRemove either `select` or `style` from the overridden allowed tags.## CreditsThis vulnerability was responsibly reported by [windshock](https://hackerone.com/windshock?type=user).","status":"published","published":"2022-06-24T15:15:11.153Z","modified":"2026-06-17T04:46:52.383Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:07:22.613788Z"}],"osv":[{"id":"GHSA-pg8v-g4xq-hww9","title":"Rails::Html::Sanitizer vulnerable to Cross-site Scripting","description":"Versions of Rails::Html::Sanitizer prior to version 1.4.3 are vulnerable to XSS with certain configurations of Rails::Html::Sanitizer which  allows an attacker to inject content when the application developer has overridden the sanitizer's allowed tags to allow both `select` and `style` elements. Code is only impacted if allowed tags are being overridden. \n\nThis may be done via application configuration: ```ruby# In config/application.rbconfig.action_view.sanitized_allowed_tags = [\"select\", \"style\"]```\n\nsee https://guides.rubyonrails.org/configuring.html#configuring-action-view\n\nOr it may be done with a `:tags` option to the Action View helper `sanitize`: ```\u003c%= sanitize @comment.body, tags: [\"select\", \"style\"] %\u003e``` \n\nsee https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html#method-i-sanitize \n\nIt may also be done with Rails::Html::SafeListSanitizer directly: \n```ruby# class-level optionRails::Html::SafeListSanitizer.allowed_tags = [\"select\", \"style\"]```  or with\n```ruby# instance-level optionRails::Html::SafeListSanitizer.new.sanitize(@article.body, tags: [\"select\", \"style\"])```\n\nAll users overriding the allowed tags by any of the above mechanisms to include both \"select\" and \"style\" are recommended to upgrade immediately. A workaround for this issue can be applied by removing either `select` or `style` from the overridden allowed tags.","status":"published","published":"2022-06-25T00:00:54Z","modified":"2025-11-04T17:02:22.780977Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:53.244788Z"},{"id":"RHSA-2022:8506","title":"Red Hat Security Advisory: Satellite 6.12 Release","status":"published","published":"2024-09-29T19:10:39Z","modified":"2026-10-13T10:03:33Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"UBUNTU-CVE-2022-32209","description":"# Possible XSS Vulnerability in Rails::Html::SanitizerThere is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer.This vulnerability has been assigned the CVE identifier CVE-2022-32209.Versions Affected: ALLNot affected: NONEFixed Versions: v1.4.3## ImpactA possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags to allow both `select` and `style` elements.Code is only impacted if allowed tags are being overridden. This may be done via application configuration:```ruby# In config/application.rbconfig.action_view.sanitized_allowed_tags = [\"select\", \"style\"]```see https://guides.rubyonrails.org/configuring.html#configuring-action-viewOr it may be done with a `:tags` option to the Action View helper `sanitize`:```\u003c%= sanitize @comment.body, tags: [\"select\", \"style\"] %\u003e```see https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html#method-i-sanitizeOr it may be done with Rails::Html::SafeListSanitizer directly:```ruby# class-level optionRails::Html::SafeListSanitizer.allowed_tags = [\"select\", \"style\"]```or```ruby# instance-level optionRails::Html::SafeListSanitizer.new.sanitize(@article.body, tags: [\"select\", \"style\"])```All users overriding the allowed tags by any of the above mechanisms to include both \"select\" and \"style\" should either upgrade or use one of the workarounds immediately.## ReleasesThe FIXED releases are available at the normal locations.## WorkaroundsRemove either `select` or `style` from the overridden allowed tags.## CreditsThis vulnerability was responsibly reported by [windshock](https://hackerone.com/windshock?type=user).","status":"published","published":"2022-06-24T15:15:00Z","modified":"2025-10-24T04:53:42Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:53:54.697021Z"},{"id":"CVE-2022-32209","description":"# Possible XSS Vulnerability in Rails::Html::SanitizerThere is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer.This vulnerability has been assigned the CVE identifier CVE-2022-32209.Versions Affected: ALLNot affected: NONEFixed Versions: v1.4.3## ImpactA possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags to allow both `select` and `style` elements.Code is only impacted if allowed tags are being overridden. This may be done via application configuration:```ruby# In config/application.rbconfig.action_view.sanitized_allowed_tags = [\"select\", \"style\"]```see https://guides.rubyonrails.org/configuring.html#configuring-action-viewOr it may be done with a `:tags` option to the Action View helper `sanitize`:```\u003c%= sanitize @comment.body, tags: [\"select\", \"style\"] %\u003e```see https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html#method-i-sanitizeOr it may be done with Rails::Html::SafeListSanitizer directly:```ruby# class-level optionRails::Html::SafeListSanitizer.allowed_tags = [\"select\", \"style\"]```or```ruby# instance-level optionRails::Html::SafeListSanitizer.new.sanitize(@article.body, tags: [\"select\", \"style\"])```All users overriding the allowed tags by any of the above mechanisms to include both \"select\" and \"style\" should either upgrade or use one of the workarounds immediately.## ReleasesThe FIXED releases are available at the normal locations.## WorkaroundsRemove either `select` or `style` from the overridden allowed tags.## CreditsThis vulnerability was responsibly reported by [windshock](https://hackerone.com/windshock?type=user).","status":"published","published":"2022-06-24T00:00:00Z","modified":"2026-10-28T02:30:49.246871908Z","cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:25.860945Z"},{"id":"DEBIAN-CVE-2022-32209","description":"# Possible XSS Vulnerability in Rails::Html::SanitizerThere is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer.This vulnerability has been assigned the CVE identifier CVE-2022-32209.Versions Affected: ALLNot affected: NONEFixed Versions: v1.4.3## ImpactA possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags to allow both `select` and `style` elements.Code is only impacted if allowed tags are being overridden. This may be done via application configuration:```ruby# In config/application.rbconfig.action_view.sanitized_allowed_tags = [\"select\", \"style\"]```see https://guides.rubyonrails.org/configuring.html#configuring-action-viewOr it may be done with a `:tags` option to the Action View helper `sanitize`:```\u003c%= sanitize @comment.body, tags: [\"select\", \"style\"] %\u003e```see https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html#method-i-sanitizeOr it may be done with Rails::Html::SafeListSanitizer directly:```ruby# class-level optionRails::Html::SafeListSanitizer.allowed_tags = [\"select\", \"style\"]```or```ruby# instance-level optionRails::Html::SafeListSanitizer.new.sanitize(@article.body, tags: [\"select\", \"style\"])```All users overriding the allowed tags by any of the above mechanisms to include both \"select\" and \"style\" should either upgrade or use one of the workarounds immediately.## ReleasesThe FIXED releases are available at the normal locations.## WorkaroundsRemove either `select` or `style` from the overridden allowed tags.## CreditsThis vulnerability was responsibly reported by [windshock](https://hackerone.com/windshock?type=user).","status":"published","published":"2022-06-24T15:15:11.153Z","modified":"2026-11-03T06:02:32.920002692Z","updated_at":"2026-11-03T06:44:05.456691Z"},{"id":"DLA-3227-1","title":"ruby-rails-html-sanitizer - security update","status":"published","published":"2022-12-07T00:00:00Z","modified":"2026-03-09T01:22:59.640358Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"DLA-3902-1","title":"ruby-rails-html-sanitizer - security update","status":"published","published":"2024-09-28T00:00:00Z","modified":"2026-03-09T01:19:39.683808Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"openSUSE-SU-2024:12145-1","title":"ruby3.1-rubygem-rails-html-sanitizer-1.4.3-1.1 on GA media","description":"These are all security issues fixed in the ruby3.1-rubygem-rails-html-sanitizer-1.4.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:13:52.92798Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"openSUSE-SU-2024:13137-1","title":"ruby3.2-rubygem-rails-html-sanitizer-1.5.0-2.1 on GA media","description":"These are all security issues fixed in the ruby3.2-rubygem-rails-html-sanitizer-1.5.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:31:42.840413Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"openSUSE-SU-2024:14175-1","title":"ruby3.3-rubygem-rails-html-sanitizer-1.6.0-1.5 on GA media","description":"These are all security issues fixed in the ruby3.3-rubygem-rails-html-sanitizer-1.6.0-1.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-07-12T00:00:00Z","modified":"2026-02-04T04:30:17.606646Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2025:15125-1","title":"ruby3.4-rubygem-rails-html-sanitizer-1.6.0-1.7 on GA media","description":"These are all security issues fixed in the ruby3.4-rubygem-rails-html-sanitizer-1.6.0-1.7 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-05-17T00:00:00Z","modified":"2026-02-04T04:04:42.907486Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"openSUSE-SU-2026:10361-1","title":"ruby4.0-rubygem-rails-html-sanitizer-1.6.0-1.9 on GA media","description":"These are all security issues fixed in the ruby4.0-rubygem-rails-html-sanitizer-1.6.0-1.9 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-03-13T00:00:00Z","modified":"2026-03-14T08:26:09.712889Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"RLSA-2022:8506","title":"Important: Satellite 6.12 Release","description":"Rocky Enterprise Software Foundation Satellite is a systems management tool for Linux-based\ninfrastructure. It allows for provisioning, remote management, and\nmonitoring of multiple Linux deployments with a single centralized tool.\n\nSecurity Fix(es):\n* netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data (CVE-2021-37136)\n* netty-codec: SnappyFrameDecoder doesn't restrict chunk length and may buffer skippable chunks in an unnecessary way (CVE-2021-37137)\n* python3-django: Possible XSS via template tag (CVE-2022-22818)\n* tfm-rubygem-nokogiri: ReDoS in HTML encoding detection (CVE-2022-24836)\n* tfm-rubygem-sinatra: Path traversal possible outside of public_dir when serving static files (CVE-2022-29970)\n* tfm-rubygem-git: Package vulnerable to Command Injection via git argument injection (CVE-2022-25648)\n* rubygem-rails-html-sanitizer: Possible XSS with certain configurations (CVE-2022-32209)\n* python3-django: Potential SQL injection via Trunc and Extract arguments (CVE-2022-34265)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s) listed in the References section.\n\nAdditional Changes:\n\nThe items above are not a complete list of changes. This update also fixes\nseveral bugs and adds various enhancements. Documentation for these changes\nis available from the Release Notes document.","status":"published","published":"2022-11-16T13:21:30Z","modified":"2026-02-04T16:00:10.880515Z","updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"SUSE-SU-2022:2870-1","title":"Security update for rubygem-rails-html-sanitizer","description":"This update for rubygem-rails-html-sanitizer fixes the following issues:\n\n- CVE-2022-32209: Fixed a potential content injection under specific\n  configurations (bsc#1201183).\n","status":"published","published":"2022-08-22T21:03:23Z","modified":"2026-02-04T04:33:36.296516Z","updated_at":"2026-11-02T15:53:50.965375Z"},{"id":"SUSE-SU-2022:2885-1","title":"Security update for rubygem-rails-html-sanitizer","description":"This update for rubygem-rails-html-sanitizer fixes the following issues:\n\n- CVE-2022-32209: Fixed a potential content injection under specific\n  configurations (bsc#1201183).\n","status":"published","published":"2022-08-24T12:37:41Z","modified":"2026-02-04T02:27:19.533058Z","updated_at":"2026-11-02T15:53:50.965375Z"}]}}