CVE-2021-35043 — Cross-site Scripting in OWASP AntiSamy

Description

OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected). This was demonstrated by a javascript: URL with &#00058 as the replacement for the : character.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	libowasp-antisamy-java	1.7.4-1	—
Debian 13	libowasp-antisamy-java	1.7.4-1	—
Debian 12	libowasp-antisamy-java	No fix yet	—

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 26.10	libowasp-antisamy-java	No fix yet	—
Ubuntu 26.04 LTS	libowasp-antisamy-java	No fix yet	—
Ubuntu 25.10	libowasp-antisamy-java	No fix yet	—
Ubuntu 24.04 LTS	libowasp-antisamy-java	No fix yet	—
Ubuntu 22.04 LTS	libowasp-antisamy-java	No fix yet	—

Show 3 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu 20.04 LTS	libowasp-antisamy-java	No fix yet	—
Ubuntu 18.04 LTS	libowasp-antisamy-java	No fix yet	—
Ubuntu 16.04 LTS	libowasp-antisamy-java	No fix yet	—

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.owasp.antisamy:antisamy	>= 1.5.7, < 1.6.4	1.6.4	GHSA-9c8w-jrw3-q2c3

Advisories 1

WID-SEC-2023-1012 Oracle Insurance Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 18, 2023

Cross-site Scripting in OWASP AntiSamy