Security update for jsoup SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:4011-1 Final 1 1 2022-11-16T10:29:29Z current 2022-11-16T10:29:29Z 2022-11-16T10:29:29Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for jsoup This update for jsoup fixes the following issues: Updated to version 1.15.3: - CVE-2022-36033: Fixed incorrect sanitization of user input in SafeList.preserveRelativeLinks (bsc#1203459). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Container bci/openjdk-devel:11-2022-4011,Container bci/openjdk-devel:latest-2022-4011,SUSE-2022-4011,SUSE-SLE-Module-Development-Tools-15-SP3-2022-4011,SUSE-SLE-Module-Development-Tools-15-SP4-2022-4011,openSUSE-SLE-15.3-2022-4011,openSUSE-SLE-15.4-2022-4011 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20224011-1/ Link for SUSE-SU-2022:4011-1 https://lists.suse.com/pipermail/sle-security-updates/2022-November/012941.html E-Mail link for SUSE-SU-2022:4011-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1203459 SUSE Bug 1203459 https://www.suse.com/security/cve/CVE-2022-36033/ SUSE CVE CVE-2022-36033 page Container bci/openjdk-devel:11 Container bci/openjdk-devel:latest SUSE Linux Enterprise Module for Development Tools 15 SP3 SUSE Linux Enterprise Module for Development Tools 15 SP4 openSUSE Leap 15.3 openSUSE Leap 15.4 jsoup-1.15.3-150200.3.6.1 jsoup-javadoc-1.15.3-150200.3.6.1 jsoup-1.15.3-150200.3.6.1 as a component of Container bci/openjdk-devel:11 jsoup-1.15.3-150200.3.6.1 as a component of Container bci/openjdk-devel:latest jsoup-1.15.3-150200.3.6.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP3 jsoup-1.15.3-150200.3.6.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP4 jsoup-1.15.3-150200.3.6.1 as a component of openSUSE Leap 15.3 jsoup-javadoc-1.15.3-150200.3.6.1 as a component of openSUSE Leap 15.3 jsoup-1.15.3-150200.3.6.1 as a component of openSUSE Leap 15.4 jsoup-javadoc-1.15.3-150200.3.6.1 as a component of openSUSE Leap 15.4 jsoup is a Java HTML parser, built for HTML editing, cleaning, scraping, and cross-site scripting (XSS) safety. jsoup may incorrectly sanitize HTML including `javascript:` URL expressions, which could allow XSS attacks when a reader subsequently clicks that link. If the non-default `SafeList.preserveRelativeLinks` option is enabled, HTML including `javascript:` URLs that have been crafted with control characters will not be sanitized. If the site that this HTML is published on does not set a Content Security Policy, an XSS attack is then possible. This issue is patched in jsoup 1.15.3. Users should upgrade to this version. Additionally, as the unsanitized input may have been persisted, old content should be cleaned again using the updated version. To remediate this issue without immediately upgrading: - disable `SafeList.preserveRelativeLinks`, which will rewrite input URLs as absolute URLs - ensure an appropriate [Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) is defined. (This should be used regardless of upgrading, as a defence-in-depth best practice.) CVE-2022-36033 Container bci/openjdk-devel:11:jsoup-1.15.3-150200.3.6.1 Container bci/openjdk-devel:latest:jsoup-1.15.3-150200.3.6.1 SUSE Linux Enterprise Module for Development Tools 15 SP3:jsoup-1.15.3-150200.3.6.1 SUSE Linux Enterprise Module for Development Tools 15 SP4:jsoup-1.15.3-150200.3.6.1 openSUSE Leap 15.3:jsoup-1.15.3-150200.3.6.1 openSUSE Leap 15.3:jsoup-javadoc-1.15.3-150200.3.6.1 openSUSE Leap 15.4:jsoup-1.15.3-150200.3.6.1 openSUSE Leap 15.4:jsoup-javadoc-1.15.3-150200.3.6.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20224011-1/ https://www.suse.com/security/cve/CVE-2022-36033.html CVE-2022-36033 https://bugzilla.suse.com/1203459 SUSE Bug 1203459