Denial of Service Vulnerability in libowasp-antisamy-java: Heap Memory Consumption via Crafted Input
Summary
DEBIAN-CVE-2022-28366: Certain Neko-related HTML parsers allow a denial of service via crafted Processing Instruction (PI) input that causes excessive heap memory consumption. Affects libowasp-antisamy-java versions < 1.7.4-1. Fixed in 1.7.4-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libowasp-antisamy-java is a Java library that provides a way to sanitize HTML and CSS input to prevent XSS attacks. It is widely used in web applications to ensure that user-generated content is safe for display. However, certain versions of this library are vulnerable to a denial of service attack due to improper handling of Processing Instructions (PI) in HTML parsing, leading to excessive heap memory consumption.
Vulnerability Detail
The vulnerability identified as CVE-2022-28366 affects libowasp-antisamy-java versions prior to 1.7.4-1. It originates from the underlying Neko-related HTML parsers, which allow crafted PI input to cause excessive memory usage, potentially leading to application crashes or slowdowns. This issue is particularly concerning for applications that rely on libowasp-antisamy-java for sanitizing user input, as it can be exploited to disrupt service availability.
How To Fix
Minimum fixed version
1.7.4-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libowasp-antisamy-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot immediately update the package, consider implementing input validation to limit the types of input that can be processed by the library. This may involve filtering out or rejecting any input that contains Processing Instructions.
Conclusion
The CVE-2022-28366 vulnerability in libowasp-antisamy-java poses a significant risk due to its potential for denial of service through excessive memory consumption. It is crucial to update to the patched version 1.7.4-1 or later to ensure the security and stability of applications using this library. Additionally, utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for libowasp-antisamy-java →
FAQ
CVE-2022-28366 is a vulnerability in libowasp-antisamy-java that allows denial of service through excessive heap memory consumption caused by crafted Processing Instruction input.
Versions prior to 1.7.4-1 are affected by this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file, you can check for vulnerabilities without needing to access the code.
Exploitation of this vulnerability can lead to application crashes or significant slowdowns, affecting service availability and user experience.
Yes, implementing input validation to filter out problematic input can help mitigate the risk until you can update to the patched version.
References
Related vulnerabilities
Recent vulnerabilities recorded for libowasp-antisamy-java.
