Security Update for libhtmlcleaner-java
Summary
DLA-3520-1: libhtmlcleaner-java - security update. Affects libhtmlcleaner-java versions < 2.21-5+deb10u1. Fixed in 2.21-5+deb10u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libhtmlcleaner-java is a Java HTML parser library used for parsing and cleaning HTML documents. It provides functionality to parse HTML and extract information from it. However, a security vulnerability has been discovered in this library that could lead to a denial of service (StackOverflowError) if the parser encounters deeply nested HTML elements in user-supplied input. To address this issue, a new nesting depth limit has been introduced in the library.
Vulnerability Detail
The vulnerability in libhtmlcleaner-java arises when the parser encounters deeply nested HTML elements in user-supplied input. This can cause a StackOverflowError, leading to a denial of service. An attacker could exploit this vulnerability by providing specially crafted input to trigger the excessive nesting and cause the parser to crash. The impact of this vulnerability is limited to a denial of service, and there is no evidence of any further exploitation or arbitrary code execution.
How To Fix
Minimum fixed version
2.21-5+deb10u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libhtmlcleaner-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
libhtmlcleaner-java has been found to have a security vulnerability that could lead to a denial of service if the parser encounters deeply nested HTML elements. To mitigate this issue, it is recommended to upgrade to the latest version of the package. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libhtmlcleaner-java →
FAQ
libhtmlcleaner-java is a Java HTML parser library used for parsing and cleaning HTML documents. It provides functionality to extract information from HTML.
The vulnerability can lead to a denial of service (StackOverflowError) if the parser encounters deeply nested HTML elements in user-supplied input.
An attacker can exploit this vulnerability by providing specially crafted input with excessive nesting of HTML elements, causing the parser to crash and resulting in a denial of service.
There is no evidence of this vulnerability being exploited in the wild. The impact is limited to a denial of service, and there is no indication of arbitrary code execution or further exploitation.
To fix this vulnerability, upgrade the libhtmlcleaner-java package to version 2.21-5+deb10u1 or later. Apply the update as soon as possible to ensure the security of applications using this library.
Related vulnerabilities
Recent vulnerabilities recorded for libhtmlcleaner-java.
