Описание
OWASP AntiSamy before 1.6.6 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| libowasp-antisamy-java | fixed | 1.7.4-1 | package | |
| libowasp-antisamy-java | ignored | bookworm | package | |
| libowasp-antisamy-java | no-dsa | bullseye | package | |
| libowasp-antisamy-java | no-dsa | buster | package | |
| libowasp-antisamy-java | no-dsa | stretch | package |
Примечания
https://github.com/nahsra/antisamy/commit/0199e7e194dba5e7d7197703f43ebe22401e61ae (v1.6.6)
Make sure to fix the issue completely and include the commit otherwise opening CVE-2022-29577
https://github.com/nahsra/antisamy/commit/32e273507da0e964b58c50fd8a4c94c9d9363af0 (v1.6.7)
EPSS
Связанные уязвимости
OWASP AntiSamy before 1.6.6 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content.
OWASP AntiSamy before 1.6.6 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content.
EPSS