Alexander, Rob
 
Thanks for your answers. Based on your input, tonight I upgraded the server from OEL 7.2  to 7.9, which updated ipa-server to ipa-server-4.6.8-5.el7.
 
The update ended with "Non-fatal POSTTRANS scriptlet failure in rpm package ipa-server-4.6.8-5.0.1.el7.x86_64", but thanks to a previous post + advice from Rob, I knew this was harmless, and what to do.
 
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org/thread/IL62EFNVWZHAPVZQHSTE2JHDBCZSOMWT/
 
Looking more closely at some of the instances of jquery.js now on the server, I find:
 
# more /usr/share/ipa/ui/js/libs/jquery.js
/*! jQuery v3.4.1 | (c) JS Foundation and other contributors | jquery.org/license */
 
--> This is the patched version, updated to 3.4.1, with back-patches from 3.5.0. As Rob points out, our enterprise security scans will probably still complain, but I can report this as false positive.
 
# more /usr/share/pki/server/webapps/pki/js/jquery.js
/*! jQuery JavaScript Library v1.10.2
 
--> unchanged.
 
# more /usr/share/doc/pki-base/html/_static/jquery.js
/*! * jQuery JavaScript Library v1.4.2
 
--> unchanged.
 
Cheers
 
Chris
 
----- Original message -----

From: Alexander Bokovoy <abokovoy@redhat.com>
To: FreeIPA users list <freeipa-users@lists.fedorahosted.org>
Cc: Christopher Lamb <christopher.lamb@ch.ibm.com>
Subject: [EXTERNAL] Re: [Freeipa-users] IPA and JQuery 1.2 < 3.5.0 XSS
Date: Wed, Oct 7, 2020 4:46 PM
 
On ke, 07 loka 2020, Christopher Lamb via FreeIPA-users wrote:
>   Hi all                                                                      
>                                                                                
>   Security scans of our ipa server report a vulnerability “JQuery 1.2 <        
>   3.5.0 XSS”.                                                                  
>                                                                                
>   The recommended fix is to upgrade jQuery to version 3.5.0 or later.          
>                                                                                
>   We are running ipa-server 4.6.4 on OEL 7.2.                                  
>                                                                                
>   The newest ipa-server version in our yum repository is 4.6.6                
>                                                                                
>   Hunting around on the server finds multiple instances and versions of        
>   jQuery.js which seem to come from ipa. e.g.                                  
>   /usr/share/doc/pki-base/html/_static/jquery.js 1.4.2                        
>   /usr/share/pki/server/webapps/pki/js/jquery.js 1.10.2                        
>   /usr/share/ipa/ui/js/libs/jquery.js 2.0.3                                    
>                                                                                
>   So how do we mitigate this vulnerability?                                    
>                                                                                
>   Googling with jQuery and IPA indicates that ipa 4.8.7 comes with jQuery      
>   3.4.1 with backported fixes from 3.5.0 (“. . . A complete upgrade to        
>   jQuery 3.5 is impossible at the moment due incompatibility with Bootstrap    
>   3.4.1 which we currently use…”).                                            
>                                                                                
>   [1]https://www.freeipa.org/page/Releases/4.8.7                                
>       •    8284: Upgrade jQuery version to actual one                          
>   Version of jQuery framework used by FreeIPA Web UI was updated to 3.4.1.    
>       •    8325: [WebUI] Fix htmlPrefilter issue in jQuery                    
>   CVE-2020-11022: In jQuery versions greater than or equal to 1.2 and before  
>   3.5.0, passing HTML from untrusted sources - even after sanitizing it - to  
>   one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and      
>   others) may execute untrusted code. FreeIPA is not allowing to pass          
>   arbitrary code into affected jQuery path but we applied jQuery fix anyway.  
>                                                                                
>   Issue 8325 indicates an IPA 4.6 patch.                                      
>   [2]https://pagure.io/freeipa/issue/8325                                      
>                                                                                
>   So would upgrading ipa-server to 4.6.6 contain this fix? Or do I have to    
>   upgrade to 4.8.7 or later (which presumably implies upgrading Linux as      
>   well)?                                                                      

RHEL 7.9 is released already and it contains a rebase to FreeIPA 4.6.8
and few patches on top of that. ipa-server-4.6.8-5.el7 contains this
patchset: https://access.redhat.com/errata/RHSA-2020:3936 


--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland