Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

TBB Password Stealing Vulnerability in Red Hat Software

published 1 year ago

Summary

An attacker can steal sensitive information from the TBB browser plugin. This is a significant risk because it allows a hacker to access sensitive data from your computer. Users should update their TBB browser plugin to the latest version to fix this issue.

What to do

Update redhat python3-tbb to version 0:2020.3-8.el9_5.1.
Update redhat python3-tbb-debuginfo to version 0:2020.3-8.el9_5.1.
Update redhat tbb to version 0:2020.3-8.el9_5.1.
Update redhat tbb-debuginfo to version 0:2020.3-8.el9_5.1.
Update redhat tbb-debugsource to version 0:2020.3-8.el9_5.1.
Update redhat tbb-devel to version 0:2020.3-8.el9_5.1.
Update redhat tbb-doc to version 0:2020.3-8.el9_5.1.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:enterprise_linux:9::appstream	redhat	python3-tbb	< 0:2020.3-8.el9_5.1 Fix: upgrade to 0:2020.3-8.el9_5.1
Red Hat:enterprise_linux:9::appstream	redhat	python3-tbb-debuginfo	< 0:2020.3-8.el9_5.1 Fix: upgrade to 0:2020.3-8.el9_5.1
Red Hat:enterprise_linux:9::appstream	redhat	tbb	< 0:2020.3-8.el9_5.1 Fix: upgrade to 0:2020.3-8.el9_5.1
Red Hat:enterprise_linux:9::appstream	redhat	tbb-debuginfo	< 0:2020.3-8.el9_5.1 Fix: upgrade to 0:2020.3-8.el9_5.1
Red Hat:enterprise_linux:9::appstream	redhat	tbb-debugsource	< 0:2020.3-8.el9_5.1 Fix: upgrade to 0:2020.3-8.el9_5.1
Red Hat:enterprise_linux:9::appstream	redhat	tbb-devel	< 0:2020.3-8.el9_5.1 Fix: upgrade to 0:2020.3-8.el9_5.1
Red Hat:enterprise_linux:9::appstream	redhat	tbb-doc	< 0:2020.3-8.el9_5.1 Fix: upgrade to 0:2020.3-8.el9_5.1

Original advisory text

Red Hat Security Advisory: tbb security update

References

https://access.redhat.com/errata/RHSA-2025:1210 Vendor Advisory
https://access.redhat.com/security/updates/classification/#moderate Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1850004 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_1210.j... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2020-11023 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2020-11023 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-11023 Vendor Advisory
https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/ Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

6.1 Medium

Timeline

Published11 Feb 2025

Updated6 Mar 2026

First seen6 Mar 2026

Sources

RHSA-2025:1210 · OSV

Track software like this

Free during beta