CVE-2020-11082

Name	CVE-2020-11082
Description	In Kaminari before 1.2.1, there is a vulnerability that would allow an attacker to inject arbitrary code into pages with pagination links. This has been fixed in 1.2.1.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severity	medium
Debian Bugs	961847

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
ruby-kaminari (PTS)	stretch	0.17.0-3	vulnerable
	buster	1.0.1-4	vulnerable
	bullseye, sid	1.2.1-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
ruby-kaminari	source	(unstable)	1.0.1-6			961847

Notes

[jessie] - ruby-kaminari <no-dsa> (No reverse dependency)
https://github.com/kaminari/kaminari/security/advisories/GHSA-r5jw-62xg-j433
https://github.com/kaminari/kaminari/commit/8dd52a1aed3d2fa2835d836de23fc0d8c4ff5db8