{ "document": { "aggregate_severity": { "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" }, { "category": "details", "text": "CVE-2022-36033: strip control characters from URLs before protocol validation", "title": "Details" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "https://cve.tuxcare.com/els/releases/CLSA-2026:1784880925", "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1784880925" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/almalinux9.2esu/advisories/2026/clsa-2026_1784880925.json" } ], "tracking": { "current_release_date": "2026-07-24T08:16:31Z", "generator": { "date": "2026-07-24T08:16:31Z", "engine": { "name": "pyCSAF" } }, "id": "CLSA-2026:1784880925", "initial_release_date": "2026-07-24T08:16:31Z", "revision_history": [ { "date": "2026-07-24T08:16:31Z", "number": "1", "summary": "Initial version" } ], "status": "final", "version": "1" }, "title": "jsoup: Fix of CVE-2022-36033" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "AlmaLinux 9.2", "product": { "name": "AlmaLinux 9.2", "product_id": "AlmaLinux-9.2", "product_identification_helper": { "cpe": "cpe:2.3:o:almalinux:almalinux:9.2:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "AlmaLinux" } ], "category": "vendor", "name": "AlmaLinux OS Foundation" }, { "branches": [ { "branches": [ { "category": "product_version", "name": "jsoup-0:1.13.1-10.el9.tuxcare.els1.noarch", "product": { "name": "jsoup-0:1.13.1-10.el9.tuxcare.els1.noarch", "product_id": "jsoup-0:1.13.1-10.el9.tuxcare.els1.noarch", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/jsoup@1.13.1-10.el9.tuxcare.els1?arch=noarch" } } }, { "category": "product_version", "name": "jsoup-javadoc-0:1.13.1-10.el9.tuxcare.els1.noarch", "product": { "name": "jsoup-javadoc-0:1.13.1-10.el9.tuxcare.els1.noarch", "product_id": "jsoup-javadoc-0:1.13.1-10.el9.tuxcare.els1.noarch", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/jsoup-javadoc@1.13.1-10.el9.tuxcare.els1?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "jsoup-0:1.13.1-10.el9.tuxcare.els1.noarch as a component of AlmaLinux 9.2", "product_id": "AlmaLinux-9.2:jsoup-0:1.13.1-10.el9.tuxcare.els1.noarch" }, "product_reference": "jsoup-0:1.13.1-10.el9.tuxcare.els1.noarch", "relates_to_product_reference": "AlmaLinux-9.2" }, { "category": "default_component_of", "full_product_name": { "name": "jsoup-javadoc-0:1.13.1-10.el9.tuxcare.els1.noarch as a component of AlmaLinux 9.2", "product_id": "AlmaLinux-9.2:jsoup-javadoc-0:1.13.1-10.el9.tuxcare.els1.noarch" }, "product_reference": "jsoup-javadoc-0:1.13.1-10.el9.tuxcare.els1.noarch", "relates_to_product_reference": "AlmaLinux-9.2" } ] }, "vulnerabilities": [ { "cve": "CVE-2022-36033", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" }, "notes": [ { "category": "description", "text": "jsoup is a Java HTML parser, built for HTML editing, cleaning, scraping, and cross-site scripting (XSS) safety. jsoup may incorrectly sanitize HTML including `javascript:` URL expressions, which could allow XSS attacks when a reader subsequently clicks that link. If the non-default `SafeList.preserveRelativeLinks` option is enabled, HTML including `javascript:` URLs that have been crafted with control characters will not be sanitized. If the site that this HTML is published on does not set a Content Security Policy, an XSS attack is then possible. This issue is patched in jsoup 1.15.3. Users should upgrade to this version. Additionally, as the unsanitized input may have been persisted, old content should be cleaned again using the updated version. To remediate this issue without immediately upgrading: - disable `SafeList.preserveRelativeLinks`, which will rewrite input URLs as absolute URLs - ensure an appropriate [Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) is defined. (This should be used regardless of upgrading, as a defence-in-depth best practice.)", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AlmaLinux-9.2:jsoup-0:1.13.1-10.el9.tuxcare.els1.noarch", "AlmaLinux-9.2:jsoup-javadoc-0:1.13.1-10.el9.tuxcare.els1.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2022-36033" }, { "category": "external", "summary": "https://github.com/jhy/jsoup/releases/tag/jsoup-1.15.3", "url": "https://github.com/jhy/jsoup/releases/tag/jsoup-1.15.3" }, { "category": "external", "summary": "https://github.com/jhy/jsoup/security/advisories/GHSA-gp7f-rwcx-9369", "url": "https://github.com/jhy/jsoup/security/advisories/GHSA-gp7f-rwcx-9369" }, { "category": "external", "summary": "https://jsoup.org/news/release-1.15.3", "url": "https://jsoup.org/news/release-1.15.3" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20221104-0006/", "url": "https://security.netapp.com/advisory/ntap-20221104-0006/" } ], "release_date": "2022-08-29T17:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-07-24T08:15:30.570236Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1784880925", "product_ids": [ "AlmaLinux-9.2:jsoup-0:1.13.1-10.el9.tuxcare.els1.noarch", "AlmaLinux-9.2:jsoup-javadoc-0:1.13.1-10.el9.tuxcare.els1.noarch" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1784880925" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "AlmaLinux-9.2:jsoup-0:1.13.1-10.el9.tuxcare.els1.noarch", "AlmaLinux-9.2:jsoup-javadoc-0:1.13.1-10.el9.tuxcare.els1.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] } ] }