Description
Those using HtmlUnit to browse untrusted webpages may be vulnerable to Denial of service attacks (DoS). If HtmlUnit is running on user supplied web pages, an attacker may supply content that causes HtmlUnit to crash by a stack overflow. This effect may support a denial of service attack.This issue affects htmlunit before 2.70.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | htmlunit | < 2.70.0 | 2.70.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | jenkins-htmlunit-core-js | No fix yet | — |
| Ubuntu 18.04 LTS | jenkins-htmlunit-core-js | No fix yet | — |
| Ubuntu 16.04 LTS | jenkins-htmlunit-core-js | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | htmlunit | No fix yet | — |
| Ubuntu Pro 16.04 LTS | htmlunit | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.htmlunit:htmlunit | < 2.70.0 | 2.70.0 | GHSA-rc44-5cmh-879m |
Advisories 1
- WID-SEC-2023-1585 Red Hat Migration Toolkit for Runtimes: Mehrere Schwachstellen ermöglichen Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Aug 13, 2023