Owncast is an open source, self-hosted live video streaming and chat server. In affected versions inline scripts are executed when Javascript is parsed via a paste action. This issue is patched in 0.0.9 by blocking unsafe-inline Content Security Policy and specifying the script-src. The worker-src is required to be set to blob for the video player.
References
Link | Resource |
---|---|
https://github.com/owncast/owncast/security/advisories/GHSA-2hfj-cxw7-g45p | Exploit Patch Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: GitHub_M
Published: 2021-12-14T20:05:12
Updated: 2021-12-14T20:05:12
Reserved: 2021-08-16T00:00:00
Link: CVE-2021-39183
JSON object: View
NVD Information
Status : Analyzed
Published: 2021-12-14T20:15:07.490
Modified: 2021-12-20T20:38:47.083
Link: CVE-2021-39183
JSON object: View
Redhat Information
No data.
CWE