Moderate Vulnerability in TBB Packages: Untrusted Code Execution Risk
Summary
ALSA-2025:1215: Moderate: tbb security update. Affects python3-tbb versions < 2018.2-10.el8_10.1. Fixed in 2018.2-10.el8_10.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Threading Building Blocks (TBB) is a C++ runtime library designed to simplify the development of parallel applications by abstracting low-level threading details. It enhances multi-core performance by providing a rich set of algorithms and data structures. However, a security vulnerability has been identified in TBB, specifically affecting the packages python3-tbb, tbb, tbb-devel, and tbb-doc in AlmaLinux 8, which could lead to untrusted code execution through improper handling of HTML elements.
Vulnerability Detail
The vulnerability arises from the handling of HTML passed to DOM manipulation methods, specifically through the <option> tag. This flaw allows untrusted code execution, potentially enabling attackers to execute arbitrary scripts in the context of the user’s session. The issue is documented under CVE-2020-11023, and it poses a moderate risk as it can lead to unauthorized actions being performed on behalf of the user, compromising the integrity and confidentiality of the application.
How To Fix
Minimum fixed version
2018.2-10.el8_10.1
This is the first release that contains the fix.
sudo dnf update python3-tbbTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, avoid using the DOM manipulation methods that accept HTML input until the packages are updated. This can help mitigate the risk of untrusted code execution while waiting for the official patch.
Conclusion
In summary, a moderate vulnerability has been identified in the TBB packages, which could lead to untrusted code execution through improper handling of HTML. It is crucial to update the affected packages to the patched version to mitigate this risk. Users are encouraged to check their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for python3-tbb →
FAQ
The vulnerability can lead to untrusted code execution, allowing attackers to run arbitrary scripts in the user's session, which may compromise sensitive data.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
Yes, avoid using DOM manipulation methods that accept HTML input until the packages are updated to reduce the risk of exploitation.
Detailed information about the vulnerability can be found on the CVE page for CVE-2020-11023.
The affected packages include python3-tbb, tbb, tbb-devel, and tbb-doc in AlmaLinux 8.
Related vulnerabilities
Recent vulnerabilities recorded for python3-tbb.
