CIVI-SA-2020-16: JQuery Security Update for CVE-2020-11022, CVE-2020-11023

The jQuery project released version 3.5.0, and as part of that, disclosed two security vulnerabilities that affect all prior versions. As mentioned in the jQuery blog, both are

"[...] security issues in jQuery’s DOM manipulation methods, as in .html(), .append(), and the others. Security advisories for both of these issues have been published on GitHub."

Those advisories are:

• CVE-2020-11022
• CVE-2020-11023

These vulnerabilities may be exploitable on some CiviCRM sites. This security release includes a backport to fix the specific issues -- without making any other changes to the jQuery version.