Security update for jsoup, jsr-305 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:1265-1 Final 1 1 2022-04-19T13:23:12Z current 2022-04-19T13:23:12Z 2022-04-19T13:23:12Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for jsoup, jsr-305 This update for jsoup, jsr-305 fixes the following issues: - CVE-2021-37714: Fixed infinite in untrusted HTML or XML data parsing (bsc#1189749). Changes in jsr-305: - Build with java source and target levels 8 - Upgrade to upstream version 3.0.2 Changes in jsoup: - Upgrade to upstream version 1.14.2 - Generate tarball using source service instead of a script The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Container bci/openjdk-devel:11-2022-1265,Container bci/openjdk-devel:latest-2022-1265,Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure-2022-1265,Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM-2022-1265,Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE-2022-1265,SUSE-2022-1265,SUSE-SLE-Module-Development-Tools-15-SP3-2022-1265,SUSE-SLE-Module-Development-Tools-15-SP4-2022-1265,SUSE-SLE-Product-HPC-15-SP2-ESPOS-2022-1265,SUSE-SLE-Product-HPC-15-SP2-LTSS-2022-1265,SUSE-SLE-Product-RT-15-SP2-2022-1265,SUSE-SLE-Product-SLES-15-SP2-BCL-2022-1265,SUSE-SLE-Product-SLES-15-SP2-LTSS-2022-1265,SUSE-SLE-Product-SLES_SAP-15-SP2-2022-1265,SUSE-SLE-Product-SUSE-Manager-Proxy-4.1-2022-1265,SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.1-2022-1265,SUSE-SLE-Product-SUSE-Manager-Server-4.1-2022-1265,SUSE-Storage-7-2022-1265,openSUSE-SLE-15.3-2022-1265,openSUSE-SLE-15.4-2022-1265 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20221265-1/ Link for SUSE-SU-2022:1265-1 https://lists.suse.com/pipermail/sle-security-updates/2022-April/010753.html E-Mail link for SUSE-SU-2022:1265-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1189749 SUSE Bug 1189749 https://www.suse.com/security/cve/CVE-2021-37714/ SUSE CVE CVE-2021-37714 page Container bci/openjdk-devel:11 Container bci/openjdk-devel:latest Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE SUSE Enterprise Storage 7 SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS SUSE Linux Enterprise Module for Development Tools 15 SP3 SUSE Linux Enterprise Real Time 15 SP2 SUSE Linux Enterprise Server 15 SP2-BCL SUSE Linux Enterprise Server 15 SP2-LTSS SUSE Linux Enterprise Server for SAP Applications 15 SP2 SUSE Manager Proxy 4.1 SUSE Manager Retail Branch Server 4.1 SUSE Manager Server 4.1 openSUSE Leap 15.3 jsoup-1.14.2-150200.3.3.1 jsr-305-3.0.2-150200.3.3.1 jsoup-javadoc-1.14.2-150200.3.3.1 jsr-305-javadoc-3.0.2-150200.3.3.1 jsoup-1.14.2-150200.3.3.1 as a component of Container bci/openjdk-devel:11 jsr-305-3.0.2-150200.3.3.1 as a component of Container bci/openjdk-devel:11 jsoup-1.14.2-150200.3.3.1 as a component of Container bci/openjdk-devel:latest jsr-305-3.0.2-150200.3.3.1 as a component of Container bci/openjdk-devel:latest jsr-305-3.0.2-150200.3.3.1 as a component of Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure jsr-305-3.0.2-150200.3.3.1 as a component of Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM jsr-305-3.0.2-150200.3.3.1 as a component of Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE jsoup-1.14.2-150200.3.3.1 as a component of SUSE Enterprise Storage 7 jsr-305-3.0.2-150200.3.3.1 as a component of SUSE Enterprise Storage 7 jsoup-1.14.2-150200.3.3.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS jsr-305-3.0.2-150200.3.3.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS jsoup-1.14.2-150200.3.3.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS jsr-305-3.0.2-150200.3.3.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS jsoup-1.14.2-150200.3.3.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP3 jsr-305-3.0.2-150200.3.3.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP3 jsoup-1.14.2-150200.3.3.1 as a component of SUSE Linux Enterprise Real Time 15 SP2 jsr-305-3.0.2-150200.3.3.1 as a component of SUSE Linux Enterprise Real Time 15 SP2 jsoup-1.14.2-150200.3.3.1 as a component of SUSE Linux Enterprise Server 15 SP2-BCL jsr-305-3.0.2-150200.3.3.1 as a component of SUSE Linux Enterprise Server 15 SP2-BCL jsoup-1.14.2-150200.3.3.1 as a component of SUSE Linux Enterprise Server 15 SP2-LTSS jsr-305-3.0.2-150200.3.3.1 as a component of SUSE Linux Enterprise Server 15 SP2-LTSS jsoup-1.14.2-150200.3.3.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP2 jsr-305-3.0.2-150200.3.3.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP2 jsoup-1.14.2-150200.3.3.1 as a component of SUSE Manager Proxy 4.1 jsr-305-3.0.2-150200.3.3.1 as a component of SUSE Manager Proxy 4.1 jsoup-1.14.2-150200.3.3.1 as a component of SUSE Manager Retail Branch Server 4.1 jsr-305-3.0.2-150200.3.3.1 as a component of SUSE Manager Retail Branch Server 4.1 jsoup-1.14.2-150200.3.3.1 as a component of SUSE Manager Server 4.1 jsr-305-3.0.2-150200.3.3.1 as a component of SUSE Manager Server 4.1 jsoup-1.14.2-150200.3.3.1 as a component of openSUSE Leap 15.3 jsoup-javadoc-1.14.2-150200.3.3.1 as a component of openSUSE Leap 15.3 jsr-305-3.0.2-150200.3.3.1 as a component of openSUSE Leap 15.3 jsr-305-javadoc-3.0.2-150200.3.3.1 as a component of openSUSE Leap 15.3 jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck (loop indefinitely until cancelled), to complete more slowly than usual, or to throw an unexpected exception. This effect may support a denial of service attack. The issue is patched in version 1.14.2. There are a few available workarounds. Users may rate limit input parsing, limit the size of inputs based on system resources, and/or implement thread watchdogs to cap and timeout parse runtimes. CVE-2021-37714 Container bci/openjdk-devel:11:jsoup-1.14.2-150200.3.3.1 Container bci/openjdk-devel:11:jsr-305-3.0.2-150200.3.3.1 Container bci/openjdk-devel:latest:jsoup-1.14.2-150200.3.3.1 Container bci/openjdk-devel:latest:jsr-305-3.0.2-150200.3.3.1 Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure:jsr-305-3.0.2-150200.3.3.1 Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM:jsr-305-3.0.2-150200.3.3.1 Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE:jsr-305-3.0.2-150200.3.3.1 SUSE Enterprise Storage 7:jsoup-1.14.2-150200.3.3.1 SUSE Enterprise Storage 7:jsr-305-3.0.2-150200.3.3.1 SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:jsoup-1.14.2-150200.3.3.1 SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:jsr-305-3.0.2-150200.3.3.1 SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:jsoup-1.14.2-150200.3.3.1 SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:jsr-305-3.0.2-150200.3.3.1 SUSE Linux Enterprise Module for Development Tools 15 SP3:jsoup-1.14.2-150200.3.3.1 SUSE Linux Enterprise Module for Development Tools 15 SP3:jsr-305-3.0.2-150200.3.3.1 SUSE Linux Enterprise Real Time 15 SP2:jsoup-1.14.2-150200.3.3.1 SUSE Linux Enterprise Real Time 15 SP2:jsr-305-3.0.2-150200.3.3.1 SUSE Linux Enterprise Server 15 SP2-BCL:jsoup-1.14.2-150200.3.3.1 SUSE Linux Enterprise Server 15 SP2-BCL:jsr-305-3.0.2-150200.3.3.1 SUSE Linux Enterprise Server 15 SP2-LTSS:jsoup-1.14.2-150200.3.3.1 SUSE Linux Enterprise Server 15 SP2-LTSS:jsr-305-3.0.2-150200.3.3.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2:jsoup-1.14.2-150200.3.3.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2:jsr-305-3.0.2-150200.3.3.1 SUSE Manager Proxy 4.1:jsoup-1.14.2-150200.3.3.1 SUSE Manager Proxy 4.1:jsr-305-3.0.2-150200.3.3.1 SUSE Manager Retail Branch Server 4.1:jsoup-1.14.2-150200.3.3.1 SUSE Manager Retail Branch Server 4.1:jsr-305-3.0.2-150200.3.3.1 SUSE Manager Server 4.1:jsoup-1.14.2-150200.3.3.1 SUSE Manager Server 4.1:jsr-305-3.0.2-150200.3.3.1 openSUSE Leap 15.3:jsoup-1.14.2-150200.3.3.1 openSUSE Leap 15.3:jsoup-javadoc-1.14.2-150200.3.3.1 openSUSE Leap 15.3:jsr-305-3.0.2-150200.3.3.1 openSUSE Leap 15.3:jsr-305-javadoc-3.0.2-150200.3.3.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20221265-1/ https://www.suse.com/security/cve/CVE-2021-37714.html CVE-2021-37714 https://bugzilla.suse.com/1189749 SUSE Bug 1189749