Denial of Service Vulnerability in libhtmlcleaner-java: Impact of Cyclic Dependencies
Summary
DEBIAN-CVE-2023-34624: An issue was discovered htmlcleaner thru = 2.28 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies. Affects libhtmlcleaner-java versions < 2.24-1+deb11u1. Fixed in 2.24-1+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libhtmlcleaner-java is a Java library designed for cleaning and parsing HTML content. It provides functionalities to sanitize and manipulate HTML documents, making it a valuable tool for developers dealing with web content. However, a vulnerability has been identified that allows attackers to exploit cyclic dependencies within the library, potentially leading to denial of service.
Vulnerability Detail
An issue was discovered in htmlcleaner versions up to 2.28, which allows attackers to cause a denial of service or other unspecified impacts via crafted objects that utilize cyclic dependencies. This vulnerability can lead to resource exhaustion, making the application unresponsive and affecting its availability.
How To Fix
Minimum fixed version
2.24-1+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libhtmlcleaner-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the affected versions of libhtmlcleaner-java until an update can be applied. Consider implementing input validation to mitigate the risk of crafted objects being processed by the library.
Conclusion
The libhtmlcleaner-java package has a vulnerability that can lead to denial of service due to cyclic dependencies. It is crucial to update to the patched versions to mitigate this risk. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for libhtmlcleaner-java →
FAQ
The vulnerability allows attackers to exploit cyclic dependencies, potentially leading to denial of service.
Versions up to 2.28 are affected in Debian 11, and versions up to 2.29 are affected in Debian 13 and 14.
You can use the Vulert playground at Vulert Scanner to check if your application is affected without requiring any signup.
As a temporary measure, avoid using the affected versions and implement input validation to reduce the risk.
Detailed information can be found in the Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-34624.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for libhtmlcleaner-java.
