Strix
26.1K

CVE-2021-37714

HIGHCVSS 7.5/10EPSS 6.87%

Last modified

CVE-2021-37714 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. EPSS estimates a 6.87% chance of exploitation in the next 30 days.

Description

jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck (loop indefinitely until cancelled), to complete more slowly than usual, or to throw an unexpected exception. This effect may support a denial of service attack. The issue is patched in version 1.14.2. There are a few available workarounds. Users may rate limit input parsing, limit the size of inputs based on system resources, and/or implement thread watchdogs to cap and timeout parse runtimes.

Metrics

CVSS 3.1
7.5/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Probability
6.87%

93.2th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
JsoupJsoup< 1.14.2
QuarkusQuarkus<= 2.2.3
OracleBanking Trade Finance14.5
OracleBanking Treasury Management14.5
OracleBusiness Process Management Suite12.2.1.3.0
OracleBusiness Process Management Suite12.2.1.4.0
OracleFlexcube Universal Banking>= 14.0.0, <= 14.3.0
OracleFlexcube Universal Banking14.5
OracleHospitality Token Proxy Service19.2
OraclePeoplesoft Enterprise Peopletools8.58
OraclePeoplesoft Enterprise Peopletools8.59
OraclePrimavera Unifier20.12
OraclePrimavera Unifier21.12
OracleRetail Customer Management And Segmentation Foundation>= 17.0, <= 19.0
OracleWebcenter Portal12.2.1.3.0
OracleWebcenter Portal12.2.1.4.0
OracleCommunications Messaging Server8.1
NetappManagement Services For Element Software And Netapp HciAll versions
OracleFinancial Services Crime And Compliance Management Studio8.0.8.2.0
OracleFinancial Services Crime And Compliance Management Studio8.0.8.3.0
OracleMiddleware Common Libraries And Tools12.2.1.3.0
OracleMiddleware Common Libraries And Tools12.2.1.4.0
OracleStream Analytics< 19.1.0.0.6.4
OracleStream Analytics19c

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2021-37714?
jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck (loop indefinitely until cancelled), to complete more slowly than usual, or to throw an unexpected exception. This effect may support a denial of service attack. The issue is patched in version 1.14.2. There are a few available workarounds. Users may rate limit input parsing, limit the size of inputs based on system resources, and/or implement thread watchdogs to cap and timeout parse runtimes.
How severe is CVE-2021-37714?
CVE-2021-37714 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 6.87% probability of exploitation in the next 30 days.
How do I fix CVE-2021-37714?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2021-37714?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST