NetSight
IP …
high7.5

CVE-2021-37714

Uncaught Exception in jsoup

Impact

### Impact _What kind of vulnerability is it? Who is impacted?_ Those using jsoup to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck (loop indefinitely until cancelled), to complete more slowly than usual, or to throw an unexpected exception. This effect may support a denial of service attack. ### Patches _Has the problem been patched? What versions should users upgrade to?_ Users should upgrade to jsoup 1.14.2 ### Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_ Users may rate limit input parsing. Users should limit the size of inputs based on system resources. Users should implement thread watchdogs to cap and timeout parse runtimes.

Affected packages

EcosystemPackageAffectedFixed in
mavenorg.jsoup:jsoup< 1.14.21.14.2

Affected products

VendorProductAffected versions
JsoupJsoup
before 1.14.2
QuarkusQuarkus
through 2.2.3
OracleBanking Trade Finance
Version 14.5
OracleBanking Treasury Management
Version 14.5
OracleBusiness Process Management Suite
Versions 12.2.1.3.0, 12.2.1.4.0
OracleFlexcube Universal Banking
from 14.0.0 through 14.3.0
Version 14.5
OracleHospitality Token Proxy Service
Version 19.2
OraclePeoplesoft Enterprise Peopletools
Versions 8.58, 8.59
OraclePrimavera Unifier
Versions 20.12, 21.12
OracleRetail Customer Management And Segmentation Foundation
from 17.0 through 19.0
OracleWebcenter Portal
Versions 12.2.1.3.0, 12.2.1.4.0
OracleCommunications Messaging Server
Version 8.1

Weakness classification

CWE-248CWE-835

References