Moderate Security Update for Threading Building Blocks (TBB) - Untrusted Code Execution Vulnerability
Summary
ALSA-2025:1210: Moderate: tbb security update. Affects python3-tbb versions < 2020.3-8.el9_5.1. Fixed in 2020.3-8.el9_5.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Threading Building Blocks (TBB) is a C++ runtime library designed to simplify the development of multi-threaded applications. It abstracts the complexities of low-level threading, enabling developers to optimize performance on multi-core processors. TBB is widely used in various applications for its efficiency and ease of use. However, it has been found to be vulnerable to a security issue that allows untrusted code execution, particularly when handling HTML content passed to DOM manipulation methods.
Vulnerability Detail
The vulnerability arises from the handling of HTML content within TBB, specifically through the use of the <option> tag in DOM manipulation methods. This flaw can lead to untrusted code execution, potentially allowing an attacker to execute arbitrary code within the context of the application. The issue is identified as CVE-2020-11023, and it poses a moderate risk as it can compromise the integrity and security of applications utilizing TBB.
How To Fix
Minimum fixed version
2020.3-8.el9_5.1
This is the first release that contains the fix.
sudo dnf update python3-tbbTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing input validation and sanitization for any HTML content processed by the application. This can help mitigate the risk of untrusted code execution until the packages are updated.
Conclusion
The vulnerability identified in the Threading Building Blocks (TBB) library poses a moderate risk due to the potential for untrusted code execution. It is crucial to update the affected packages to the patched version to safeguard applications. Additionally, implementing workarounds can help mitigate risks until updates are applied.
See every vulnerability recorded for python3-tbb →
FAQ
CVE-2020-11023 is a security vulnerability in the Threading Building Blocks (TBB) library that allows untrusted code execution via the <option> tag in HTML.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to arbitrary code execution, compromising the security and integrity of applications that utilize the TBB library.
Yes, implementing input validation and sanitization for HTML content can help mitigate the risk until the packages are updated.
If immediate updates are not possible, ensure that you have implemented proper security measures such as input validation and monitoring for suspicious activity.
Related vulnerabilities
Recent vulnerabilities recorded for python3-tbb.
