This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page.
View CVE-2021-35043 →
DEBIAN-CVE-2021-35043
OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected). This was demonstrated by a j...
Original description
The description as published by the source.
OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected). This was demonstrated by a javascript: URL with : as the replacement for the : character.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Debian:12
libowasp-antisamy-java
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:13
libowasp-antisamy-java
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.4-1"}]}]
Debian:14
libowasp-antisamy-java
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.4-1"}]}]
References
- advisory security-tracker.debian.org