Infinite loop in jsoup - CVE-2021-37714

Vulnerability identifier: #VU58176

CSH Severity: Medium

CVSS v4 BT: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-37714

CWE-ID: CWE-835

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop when processing untrusted HTML and XML code. A remote attacker can consume all available system resources and cause denial of service conditions.

jsoup
IBM Observability with Instana
Red Hat Integration Camel Extensions for Quarkus
Jira Software Data Center
Middleware Common Libraries and Tools
Oracle Middleware Common Libraries and Tools
Oracle Banking Treasury Management
Oracle Banking Trade Finance
Oracle Hospitality Token Proxy Service
Red Hat Integration Camel-K
IBM Security Verify Governance
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Enterprise Storage
SUSE Linux Enterprise Realtime Extension
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Server
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Development Tools
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Desktop
openSUSE Leap
openEuler
Red Hat Process Automation Manager (formerly JBoss BPM Suite)
JBoss Enterprise Application Platform
Fuse
Jira Software Server
Oracle Financial Services Crime and Compliance Management Studio
Oracle Business Process Management Suite
Stream Analytics
Oracle Communications Instant Messaging Server
PeopleSoft Enterprise PeopleTools
Oracle WebCenter Portal
Oracle FLEXCUBE Universal Banking
Oracle Retail Customer Management and Segmentation Foundation
Primavera Unifier
jsoup
jsoup-javadoc
jsr-305-javadoc
jsr-305
Red Hat Single Sign-On

Install updates from vendor's website.

jsoup - update to 1.14.2
Red Hat Process Automation Manager (formerly JBoss BPM Suite) - update to 7.13.0
JBoss Enterprise Application Platform - update to 7.4.2
Jira Software Server - addressed in versions 8.20.28, 9.4.12, 9.11.3
Jira Software Data Center - addressed in versions 8.20.28, 9.4.12, 9.11.3
Oracle FLEXCUBE Universal Banking - update to 14.3.0
Stream Analytics - update to 19.1.0.0.6.4
Red Hat Integration Camel-K - update to 1.8
jsoup - update to 1.14.2-1
jsoup - update to 1.14.2-150200.3.3.1
jsoup-javadoc - update to 1.14.2-150200.3.3.1
jsr-305-javadoc - update to 3.0.2-150200.3.3.1
jsr-305 - update to 3.0.2-150200.3.3.1
Red Hat Single Sign-On - update to 7.4.10
Fuse - update to 7.10.0
IBM Security Verify Governance - update to 10.0.1.0.3

• https://github.com/jhy/jsoup/security/advisories/GHSA-m72m-mhq2-9p6c
• https://lists.apache.org/thread.html/r685c5235235ad0c26e86d0ee987fb802c9675de6081dbf0516464e0b@%3Cnotifications.james.apache.org%3E
• https://lists.apache.org/thread.html/rc3354080fc67fb50b45b3c2d12dc4ca2a3c1c78dad3d3ba012c038aa@%3Cnotifications.james.apache.org%3E
• https://lists.apache.org/thread.html/r97404676a5cf591988faedb887d64e278f522adcaa823d89ca69defe@%3Cnotifications.james.apache.org%3E
• https://lists.apache.org/thread.html/r50e9c9466c592ca9d707a5dea549524d19e3287da08d8392f643960e@%3Cissues.maven.apache.org%3E
• https://lists.apache.org/thread.html/r215009dbf7467a9f6506d0c0024cb36cad30071010e62c9352cfaaf0@%3Cissues.maven.apache.org%3E
• https://lists.apache.org/thread.html/r377b93d79817ce649e9e68b3456e6f499747ef1643fa987b342e082e@%3Cissues.maven.apache.org%3E
• https://lists.apache.org/thread.html/r3d71f18adb78e50f626dde689161ca63d3b7491bd9718fcddfaecba7@%3Cissues.maven.apache.org%3E

• Denial of service in jsoup
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform
• Infinite loop in Oracle Communications Messaging Server
• Multiple vulnerabilities in Primavera Unifier
• Multiple vulnerabilities in Oracle FLEXCUBE Universal Banking
• Multiple vulnerabilities in Oracle Banking Treasury Management
• Multiple vulnerabilities in Oracle Banking Trade Finance
• Multiple vulnerabilities in Oracle WebCenter Portal
• Multiple vulnerabilities in Oracle Business Process Management Suite
• Multiple vulnerabilities in Oracle Hospitality Token Proxy Service
• Multiple vulnerabilities in PeopleSoft Enterprise PeopleTools
• Multiple vulnerabilities in Oracle Retail Customer Management and Segmentation Foundation
• Multiple vulnerabilities in Oracle Financial Services Crime and Compliance Management Studio
• Multiple vulnerabilities in Oracle Middleware Common Libraries and Tools
• Multiple vulnerabilities in Red Hat Integration Camel Extensions for Quarkus 2.7
• Multiple vulnerabilities in Red Hat Process Automation Manager
• Multiple vulnerabilities in Red Hat Integration Camel-K
• Multiple vulnerabilities in Middleware Common Libraries and Tools
• Multiple vulnerabilities in Stream Analytics
• Multiple vulnerabilities in IBM Security Verify Governance
• SUSE update for jsoup, jsr-305
• Multiple vulnerabilities in Oracle WebCenter Portal
• Multiple vulnerabilities in third-party components in Jira Software Data Center and Server
• Multiple vulnerabilities in IBM Observability with Instana (OnPrem)
• openEuler update for jsoup
• Multiple vulnerabilities in Fuse 7.10
• Multiple vulnerabilities in Red Hat Single Sign-On 7.4