Bug#1021739: nekohtml: CVE-2022-24839
On Sat, Jan 28, 2023 at 11:35:30PM +0100, David Prévot wrote: > Hi, > > Le Thu, Oct 13, 2022 at 09:17:02PM +0200, Moritz Mühlenhoff a écrit : > > Source: nekohtml > […] > > The following vulnerability was published for nekohtml. > > > > CVE-2022-24839[0]: > > I prepared an upload (new upstream release) of this package in order to > fix this RC-bug as part of the BSP currently happening in St-Cergue, > Switzerland. A merge request has been submitted. > > https://salsa.debian.org/java-team/nekohtml/-/merge_requests/1 > > Unless advised otherwise, I intend to upload the updated package > tomorrow. Please go ahead with the upload. Thank you! signature.asc Description: PGP signature
Bug#1021739: nekohtml: CVE-2022-24839
Hi, Le Thu, Oct 13, 2022 at 09:17:02PM +0200, Moritz Mühlenhoff a écrit : > Source: nekohtml […] > The following vulnerability was published for nekohtml. > > CVE-2022-24839[0]: I prepared an upload (new upstream release) of this package in order to fix this RC-bug as part of the BSP currently happening in St-Cergue, Switzerland. A merge request has been submitted. https://salsa.debian.org/java-team/nekohtml/-/merge_requests/1 Unless advised otherwise, I intend to upload the updated package tomorrow. Regards taffit signature.asc Description: PGP signature
Bug#1021739: nekohtml: CVE-2022-24839
Source: nekohtml X-Debbugs-CC: t...@security.debian.org Severity: grave Tags: security Hi, The following vulnerability was published for nekohtml. CVE-2022-24839[0]: | org.cyberneko.html is an html parser written in Java. The fork of | `org.cyberneko.html` used by Nokogiri (Rubygem) raises a | `java.lang.OutOfMemoryError` exception when parsing ill-formed HTML | markup. Users are advised to upgrade to `= 1.9.22.noko2`. Note: | The upstream library `org.cyberneko.html` is no longer maintained. | Nokogiri uses its own fork of this library located at | https://github.com/sparklemotion/nekohtml and this CVE applies only to | that fork. Other forks of nekohtml may have a similar vulnerability. https://github.com/sparklemotion/nekohtml/security/advisories/GHSA-9849-p7jc-9rmv https://github.com/sparklemotion/nekohtml/commit/a800fce3b079def130ed42a408ff1d09f89e773d If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2022-24839 https://www.cve.org/CVERecord?id=CVE-2022-24839 Please adjust the affected versions in the BTS as needed.
