[ALAS2-2020-1519] Amazon Linux 2 2017.12 - ALAS2-2020-1519: medium priority package update for ipa

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities:
CVE-2020-1722:
A flaw was found in IPA. When sending a very long password (>= 1,000,000 characters) to the server, the password hashing process could exhaust memory and CPU leading to a denial of service and the website becoming unresponsive. The highest threat from this vulnerability is to system availability.
1793071: CVE-2020-1722 ipa: No password length restriction leads to denial of service

CVE-2020-11022:
A Cross-site scripting (XSS) vulnerability exists in JQuery. This flaw allows an attacker with the ability to supply input to the 'HTML' function to inject Javascript into the page where that input is rendered, and have it delivered by the browser.
1828406: CVE-2020-11022 jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method

CVE-2019-8331:
A cross-site scripting vulnerability was discovered in bootstrap. If an attacker could control the data given to tooltip or popover, they could inject HTML or Javascript into the rendered page when tooltip or popover events fired.
1686454: CVE-2019-8331 bootstrap: XSS in the tooltip or popover data-template attribute

CVE-2019-11358:
A Prototype Pollution vulnerability was found in jquery. Untrusted JSON passed to the extend function could lead to modifying objects up the prototype chain, including the global Object. A crafted JSON object passed to a vulnerable method could lead to denial of service or data injection, with various consequences.
1701972: CVE-2019-11358 js-jquery: prototype pollution in object's prototype leading to denial of service or remote code execution or property injection

CVE-2018-20677:
In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property.
1668089: CVE-2018-20677 bootstrap: XSS in the affix configuration target property

CVE-2018-20676:
In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute.
1668082: CVE-2018-20676 bootstrap: XSS in the tooltip data-viewport attribute

CVE-2018-14042:
In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.
1601617: CVE-2018-14042 bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip.

CVE-2018-14040:
In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.
1601614: CVE-2018-14040 bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute

CVE-2016-10735:
In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041.
1668097: CVE-2016-10735 bootstrap: XSS in the data-target attribute

CVE-2015-9251:
jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.
1399546: CVE-2015-9251 js-jquery: Cross-site scripting via cross-domain ajax requests