UBUNTU-CVE-2025-31483

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2025-31483
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-31483.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2025-31483
Related
Published
2025-04-03T18:15:00Z
Modified
2025-04-23T15:02:48Z
Summary
[none]
Details

Miniflux is a feed reader. Due to a weak Content Security Policy on the /proxy/* route, an attacker can bypass the CSP of the media proxy and execute cross-site scripting when opening external images in a new tab/window. To mitigate the vulnerability, the CSP for the media proxy has been changed from default-src 'self' to default-src 'none'; form-action 'none'; sandbox;. This vulnerability is fixed in 2.2.7.

References

Affected packages

Ubuntu:24.10 / miniflux

Package

Name
miniflux
Purl
pkg:deb/ubuntu/miniflux@2.1.4-1?arch=source&distro=oracular

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.0.51-2
2.1.2-1
2.1.3-1
2.1.4-1

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:24.04:LTS / miniflux

Package

Name
miniflux
Purl
pkg:deb/ubuntu/miniflux@2.0.51-2ubuntu0.2?arch=source&distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.0.51-1
2.0.51-2
2.0.51-2ubuntu0.1
2.0.51-2ubuntu0.2

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:25.04 / miniflux

Package

Name
miniflux
Purl
pkg:deb/ubuntu/miniflux@2.2.6-1?arch=source&distro=plucky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.1.4-1
2.2.0-2
2.2.4-1
2.2.4-2
2.2.5-1
2.2.6-1

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}