Denial of Service Vulnerability in libhtmlcleaner-java: CVE-2023-34624
Summary
UBUNTU-CVE-2023-34624: An issue was discovered htmlcleaner thru = 2.28 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies. Affects libhtmlcleaner-java versions < 2.21-2ubuntu0.1~esm1. Fixed in 2.21-2ubuntu0.1~esm1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libhtmlcleaner-java is a Java library designed for cleaning and parsing HTML content. It provides tools for transforming HTML into a more manageable format, making it easier for developers to work with web data. However, it has been found to be vulnerable to a denial of service attack due to its handling of cyclic dependencies in crafted objects.
Vulnerability Detail
The vulnerability, identified as CVE-2023-34624, allows attackers to exploit the libhtmlcleaner-java library by sending specially crafted objects that utilize cyclic dependencies. This can lead to a denial of service, causing the application to become unresponsive or crash. The issue arises from the library's inability to properly handle these cyclic dependencies, which can result in excessive resource consumption or application failure.
How To Fix
Minimum fixed version
2.21-2ubuntu0.1~esm1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libhtmlcleaner-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not possible, consider implementing input validation to filter out potentially malicious crafted objects that could exploit this vulnerability.
Conclusion
The CVE-2023-34624 vulnerability in the libhtmlcleaner-java library poses a significant risk of denial of service attacks. It is crucial for users to update to the patched versions of the library to mitigate this risk. Additionally, utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for libhtmlcleaner-java →
FAQ
CVE-2023-34624 is a vulnerability in the libhtmlcleaner-java library that allows attackers to cause a denial of service through crafted objects with cyclic dependencies.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The main consequence is a denial of service, which can make applications using the library unresponsive or crash, impacting user experience and service availability.
Yes, patched versions of libhtmlcleaner-java are available for various Ubuntu LTS releases. Users should update to the latest versions as specified.
Vulert is a service that monitors and alerts for open-source vulnerabilities in software using a manifest file. It helps developers stay informed about vulnerabilities affecting their applications.
References
Related vulnerabilities
Recent vulnerabilities recorded for libhtmlcleaner-java.
