| Package | Affected versions | Patched versions |
|---|---|---|
| org.jsoup:jsoup | < 1.14.2 | 1.14.2 |
| jsoup | < 1.14.2 | 1.14.2 |
| banking trade finance | = 14.5 | |
| banking treasury management | = 14.5 | |
| business process management suite | = 12.2.1.3.0= 12.2.1.4.0 | |
| financial services crime and compliance management studio | = 8.0.8.2.0= 8.0.8.3.0 | |
| flexcube universal banking | = 14.5≥ 14.0.0, ≤ 14.3.0 | |
| hospitality token proxy service | = 19.2 | |
| middleware common libraries and tools | = 12.2.1.3.0= 12.2.1.4.0 | |
| peoplesoft enterprise peopletools | = 8.58= 8.59 | |
| primavera unifier | = 20.12= 21.12 | |
| retail customer management and segmentation foundation | ≥ 17.0, ≤ 19.0 | |
| stream analytics | = 19c< 19.1.0.0.6.4 | 19.1.0.0.6.4 |
| webcenter portal | = 12.2.1.3.0= 12.2.1.4.0 | |
| quarkus | ≤ 2.2.3 |
What kind of vulnerability is it? Who is impacted? Those using jsoup to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck (loop indefinitely until cancelled), to complete more slowly than usual, or to throw an unexpected exception. This effect may support a denial of service attack.
Has the problem been patched? What versions should users upgrade to? Users should upgrade to jsoup 1.14.2
Is there a way for users to fix or remediate the vulnerability without upgrading? Users may rate limit input parsing. Users should limit the size of inputs based on system resources. Users should implement thread watchdogs to cap and timeout parse runtimes.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free