[DOMPurify Security] New Release Version 2.0.17 (Security Issue)

[Security Announcements for DOMPurify and related tools]

*Intro*

A new version of DOMPurify was released today: DOMPurify 2.0.17

*Background*

An mXSS-based bypass was spotted and reported internally by Masato
Kinugawa. The issue was addressed and fixed in this release. A public
release of the bypass was later found, leading to a weekend-release.

*Fix*

DOMPurify is now aware of a behavior caused by tables inside and
around MathML elements and aggressively scrubs those for better security.

*Packages*

Updated packages are available here:
https://github.com/cure53/DOMPurify/releases/tag/2.0.17

EOF

-- 
Fon  +49 1520 8675 782
PGP  0xC26C858090F70ADA

cure53.de || keybase.io/cure53 || @cure53berlin

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <http://lists.ruhr-uni-bochum.de/pipermail/dompurify-security/attachments/20200920/6019fbaa/attachment.sig>