Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

fstec логотип

BDU:2023-05361

Опубликовано: 18 авг. 2021
Источник: fstec
CVSS3: 7.5
CVSS2: 7.8
EPSS Низкий

Описание

Уязвимость Java-библиотеки анализа, извлечения и управления данными в документах HTML jsoup связана с недостатками в обработке исключительных состояний. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, вызвать отказ в обслуживании

Вендор

Red Hat Inc.
Oracle Corp.
OpenSearch
Сообщество свободного программного обеспечения
NetApp Inc.
Elastic NV

Наименование ПО

Red Hat Enterprise Linux
Jboss BPM Suite
Business Process Management Suite
Oracle Communications Messaging Server
Jboss Fuse
Red Hat Software Collections
JBoss Enterprise Application Platform
JBoss Data Grid
Red Hat Single Sign-On
JBoss A-MQ
Red Hat OpenStack Platform
PeopleSoft Enterprise PeopleTools
Red Hat JBoss Data Virtualization
CodeReady Studio
Red Hat Process Automation
Primavera Unifier
Red Hat Integration Camel Quarkus
Red Hat JBoss Fuse Service Works
Oracle WebCenter Portal
Red Hat JBoss Enterprise Application Platform Expansion Pack
Red Hat Integration
Oracle FLEXCUBE Universal Banking
Banking Treasury Management
Oracle Banking Trade Finance
Decision Manager
Oracle Financial Services Crime and Compliance Management Studio
Logstash
jsoup
Quarkus
Jboss BRMS
Hospitality Token Proxy Service
Oracle Retail Customer Management and Segmentation Foundation
Management Service for Element Software and NetApp Hci
Middleware Common Libraries and Tools
Stream Analitics

Версия ПО

7 (Red Hat Enterprise Linux)
от 6.0 (Jboss BPM Suite)
12.2.1.3.0 (Business Process Management Suite)
8.1 (Oracle Communications Messaging Server)
8 (Red Hat Enterprise Linux)
7 (Jboss Fuse)
- (Red Hat Software Collections)
7 (JBoss Enterprise Application Platform)
7 (JBoss Data Grid)
7 (Red Hat Single Sign-On)
6.0 (JBoss A-MQ)
13.0 (Queens) (Red Hat OpenStack Platform)
8.58 (PeopleSoft Enterprise PeopleTools)
6 (Red Hat JBoss Data Virtualization)
6 (Jboss Fuse)
7.3 for RHEL 6 (JBoss Enterprise Application Platform)
7.3 for RHEL 7 (JBoss Enterprise Application Platform)
7.3 for RHEL 8 (JBoss Enterprise Application Platform)
12 (CodeReady Studio)
7 (Red Hat Process Automation)
12.2.1.4.0 (Business Process Management Suite)
20.12 (Primavera Unifier)
- (Red Hat Integration Camel Quarkus)
6 (Red Hat JBoss Fuse Service Works)
12.2.1.3.0 (Oracle WebCenter Portal)
12.2.1.4.0 (Oracle WebCenter Portal)
- (Red Hat JBoss Enterprise Application Platform Expansion Pack)
8.59 (PeopleSoft Enterprise PeopleTools)
9 (Red Hat Enterprise Linux)
- (Red Hat Integration)
14.5 (Oracle FLEXCUBE Universal Banking)
от 14.0 до 14.3 включительно (Oracle FLEXCUBE Universal Banking)
14.5 (Banking Treasury Management)
21.12 (Primavera Unifier)
14.5 (Oracle Banking Trade Finance)
7 (Decision Manager)
8.0.8.2.0 (Oracle Financial Services Crime and Compliance Management Studio)
8.0.8.3.0 (Oracle Financial Services Crime and Compliance Management Studio)
8.9.0 (Logstash)
до 1.14.2 (jsoup)
до 2.2.3 (Quarkus)
6.0 (Jboss BRMS)
19.2 (Hospitality Token Proxy Service)
от 17.0 до 19.0 (Oracle Retail Customer Management and Segmentation Foundation)
- (Management Service for Element Software and NetApp Hci)
12.2.1.3.0 (Middleware Common Libraries and Tools)
12.2.1.4.0 (Middleware Common Libraries and Tools)
до 19.1.0.0.6.4 (Stream Analitics)
8.12.1 (Logstash)

Тип ПО

Операционная система
Прикладное ПО информационных систем
Сетевое программное средство
ПО программно-аппаратного средства

Операционные системы и аппаратные платформы

-

Уровень опасности уязвимости

Высокий уровень опасности (базовая оценка CVSS 2.0 составляет 7,8)
Высокий уровень опасности (базовая оценка CVSS 3.0 составляет 7,5)

Возможные меры по устранению уязвимости

Использование рекомендаций:
Для программных продуктов Oracle Corp.:
https://www.oracle.com/security-alerts/cpuapr2022.html
https://www.oracle.com/security-alerts/cpujan2022.html
https://www.oracle.com/security-alerts/cpujul2022.html
Для программных продуктов NetApp Inc.:
https://security.netapp.com/advisory/ntap-20220210-0022/
Для программных продуктов Red Hat Inc.:
https://access.redhat.com/security/cve/CVE-2021-37714
Компенсирующие меры для программных продуктов OpenSearch:
- использование антивирусных средств защиты;
- мониторинг действий пользователей;
- запуск приложений от имени пользователя с минимальными возможными привилегиями в операционной системе;
- применение систем обнаружения и предотвращения вторжений.
Организационные меры для Logstash:
1. Ограничить использование программного средства
2. Использование аналогичного программного средства

Статус уязвимости

Подтверждена производителем

Наличие эксплойта

Данные уточняются

Информация об устранении

Уязвимость устранена

Идентификаторы других систем описаний уязвимостей

EPSS

Процентиль: 89%
0.04351
Низкий

7.5 High

CVSS3

7.8 High

CVSS2

Связанные уязвимости

CVSS3: 7.5
ubuntu
больше 4 лет назад

jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck (loop indefinitely until cancelled), to complete more slowly than usual, or to throw an unexpected exception. This effect may support a denial of service attack. The issue is patched in version 1.14.2. There are a few available workarounds. Users may rate limit input parsing, limit the size of inputs based on system resources, and/or implement thread watchdogs to cap and timeout parse runtimes.

CVSS3: 7.5
redhat
больше 4 лет назад

jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck (loop indefinitely until cancelled), to complete more slowly than usual, or to throw an unexpected exception. This effect may support a denial of service attack. The issue is patched in version 1.14.2. There are a few available workarounds. Users may rate limit input parsing, limit the size of inputs based on system resources, and/or implement thread watchdogs to cap and timeout parse runtimes.

CVSS3: 7.5
nvd
больше 4 лет назад

jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck (loop indefinitely until cancelled), to complete more slowly than usual, or to throw an unexpected exception. This effect may support a denial of service attack. The issue is patched in version 1.14.2. There are a few available workarounds. Users may rate limit input parsing, limit the size of inputs based on system resources, and/or implement thread watchdogs to cap and timeout parse runtimes.

CVSS3: 7.5
msrc
4 месяца назад

Crafted input may cause the jsoup HTML and XML parser to get stuck, timeout, or throw unchecked exceptions

CVSS3: 7.5
debian
больше 4 лет назад

jsoup is a Java library for working with HTML. Those using jsoup versi ...

EPSS

Процентиль: 89%
0.04351
Низкий

7.5 High

CVSS3

7.8 High

CVSS2