An issue was discovered htmlcleaner thru = 2.28 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - An issue was discovered htmlcleaner thru = 2.28 allows attackers to cause a denial of service or other
    unspecified impacts via crafted object that uses cyclic dependencies. (CVE-2023-34624)

The version of Oracle Agile Product Lifecycle Management (PLM) on the remote host is 9.3.6.x prior to 9.3.6.26. It is, therefore, affected by multiple vulnerabilities, including:

  - Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Export). The supported version     that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via     HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in takeover of Oracle     Agile PLM. (CVE-2024-20953)     
  - The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can     reset many streams quickly, as exploited in the wild in August through October 2023. (CVE-2023-44487)   
  - An issue was discovered htmlcleaner thru = 2.28 allows attackers to cause a denial of service or other unspecified     impacts via crafted object that uses cyclic dependencies. (CVE-2023-34624)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-6683-1 advisory.

    It was discovered that HtmlCleaner incorrectly handled certain html documents. An attacker could possibly     use this issue to cause a denial of service via application crash.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3520 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3520-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Markus Koschany     August 07, 2023                               https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : libhtmlcleaner-java     Version        : 2.21-5+deb10u1     CVE ID         : CVE-2023-34624

    A security vulnerability has been discovered in libhtmlcleaner-java, a Java     HTML parser library. An attacker was able to cause a denial of service     (StackOverflowError) if the parser runs on user supplied input with deeply     nested HTML elements. This update introduces a new nesting depth limit     which can be overridden in cleaner properties.

    For Debian 10 buster, this problem has been fixed in version     2.21-5+deb10u1.

    We recommend that you upgrade your libhtmlcleaner-java packages.

    For the detailed security status of libhtmlcleaner-java please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/libhtmlcleaner-java

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 / 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5471 advisory.

    A security vulnerability has been discovered in libhtmlcleaner-java, a Java HTML parser library. An     attacker was able to cause a denial of service (StackOverflowError) if the parser runs on user supplied     input with deeply nested HTML elements. This update introduces a new nesting depth limit which can be     overridden in cleaner properties. For the oldstable distribution (bullseye), this problem has been fixed     in version 2.24-1+deb11u1. For the stable distribution (bookworm), this problem has been fixed in version     2.26-1+deb12u1. We recommend that you upgrade your libhtmlcleaner-java packages. For the detailed security     status of libhtmlcleaner-java please refer to its security tracker page at: https://security-     tracker.debian.org/tracker/libhtmlcleaner-java

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
421668	SCA: security update for net.sourceforge.htmlcleaner:htmlcleaner (GHSA-jv4x-j47q-6qvp)	Tenable Cloud Security	SCA Checks	high
421668	SCA: security update for net.sourceforge.htmlcleaner:htmlcleaner (GHSA-jv4x-j47q-6qvp)	Tenable Self-Hosted Container Security	SCA Checks	high
216910	Oracle Agile Product Lifecycle Management (PLM) 9.3.6.x < 9.3.6.26	Nessus	Misc.	high
191719	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : HtmlCleaner vulnerability (USN-6683-1)	Nessus	Ubuntu Local Security Checks	high
179426	Debian dla-3520 : libhtmlcleaner-java - security update	Nessus	Debian Local Security Checks	high
179424	Debian DSA-5471-1 : libhtmlcleaner-java - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2023-34624

high

Tenable Plugins

high

high

high

high

high

high