Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ibmIBM2641B803CC5B6F698F27A4349942ABEEE0A931F1864DAEF1CB72FDFD279085E2
HistoryNov 08, 2022 - 8:07 p.m.

Security Bulletin: IBM Security Guardium is affected by a jsoup vulnerability (CVE-2021-37714)

2022-11-0820:07:11
www.ibm.com
59
ibm security guardium
jsoup vulnerability
cve-2021-37714
denial of service
html parser
xml parser
cvss base score 7.5
remote attacker
input validation
versions 11.0 to 11.4
security update
system update

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.009 Low

EPSS

Percentile

82.9%

JSON

Summary

IBM Security Guardium has fixed this vulnerability.

Vulnerability Details

CVEID:CVE-2021-37714
**DESCRIPTION:**jsoup is vulnerable to a denial of service, caused by improper input validation. By sending a specially-crafted input, a remote attacker could exploit this vulnerability to cause the HTML and XML parser to get stuck, timeout, or throw unchecked exceptions resulting in a denial of service condition.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/207858 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Affected Product(s) Version(s)
IBM Security Guardium 11.0
IBM Security Guardium 11.1
IBM Security Guardium 11.2
IBM Security Guardium 11.3
IBM Security Guardium 11.4

Remediation/Fixes

IBM encourages customers to update their systems promptly.

Product Versions ** Fix**
IBM Security Guardium 11.0 http://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&product=ibm/Information+Management/InfoSphere+Guardium&release=11.0&platform=Linux&function=fixId&fixids=SqlGuard_11.0p45_Bundle_May-03-2022&includeSupersedes=0&source=fc
IBM Security Guardium 11.1 http://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&product=ibm/Information+Management/InfoSphere+Guardium&release=11.0&platform=Linux&function=fixId&fixids=SqlGuard_11.0p160_Bundle_Mar-23-2022&includeSupersedes=0&source=fc
IBM Security Guardium 11.2 http://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&product=ibm/Information+Management/InfoSphere+Guardium&release=11.0&platform=Linux&function=fixId&fixids=SqlGuard_11.0p277_Bundle_Oct-26-2022&includeSupersedes=0&source=fc
IBM Security Guardium 11.3 http://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&product=ibm/Information+Management/InfoSphere+Guardium&release=11.0&platform=Linux&function=fixId&fixids=SqlGuard_11.0p360_Bundle_Mar-24-2022&includeSupersedes=0&source=fc
IBM Security Guardium 11.4 http://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&product=ibm/Information+Management/InfoSphere+Guardium&release=11.0&platform=Linux&function=fixId&fixids=SqlGuard_11.0p430_Bundle_Apr-28-2022&includeSupersedes=0&source=fc

Workarounds and Mitigations

None

Affected configurations

Vulners
Node
ibmsecurity_guardiumMatch11.0
OR
ibmsecurity_guardiumMatch11.1
OR
ibmsecurity_guardiumMatch11.2
OR
ibmsecurity_guardiumMatch11.3
OR
ibmsecurity_guardiumMatch11.4

Related

ibm 9
cvelist 1
nessus 13
osv 2
prion 1
redhatcve 1
atlassian 1
cve 1
vaadin 1
openvas 2
veracode 1
suse 1
github 1
ubuntucve 1
nvd 1
debiancve 1
cbl_mariner 1
redhat 14
oracle 4
ibm
ibm
Security Bulletin: A CVE-2021-37714 vulnerability in jsoup affects IBM Process Designer in IBM Business Automation Workflow and IBM Business Process Manager
2022-09-14 15:28:14
Security Bulletin: Vulnerability in jsoup may affect Cúram Social Program Management (CVE-2021-37714)
2021-11-25 16:13:13
Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in jsoup
2021-10-01 06:23:13
cvelist
cvelist
CVE-2021-37714 Crafted input may cause the jsoup HTML and XML parser to get stuck, timeout, or throw unchecked exceptions
2021-08-18 15:10:11
nessus
nessus
SUSE SLED15 / SLES15 Security Update : jsoup, jsr-305 (SUSE-SU-2022:1265-1)
2022-04-21 00:00:00
RHEL 7 : jsoup (Unpatched Vulnerability)
2024-05-11 00:00:00
Jenkins Enterprise and Operations Center < 2.277.43.0.3 / 2.319.1.5 Multiple Vulnerabilities (CloudBees Security Advisory 2021-12-01)
2022-02-16 00:00:00
osv
osv
Uncaught Exception in jsoup
2021-08-23 19:42:38
CVE-2021-37714
2021-08-18 15:15:08
prion
prion
Input validation
2021-08-18 15:15:00
redhatcve
redhatcve
CVE-2021-37714
2021-08-18 17:35:05
atlassian
atlassian
DoS (Denial of Service) org.jsoup:jsoup in Jira Software Data Center and Server
2023-11-12 13:45:30
cve
cve
CVE-2021-37714
2021-08-18 15:15:08
vaadin
vaadin
Denial of service in third-party component in Vaadin 7 and 8
2021-10-27 00:00:00
openvas
openvas
openSUSE: Security Advisory for jsoup, (SUSE-SU-2022:1265-1)
2022-05-17 00:00:00
SUSE: Security Advisory (SUSE-SU-2022:1265-1)
2022-04-20 00:00:00
veracode
veracode
Denial Of Service
2021-08-19 02:33:54
suse
suse
Security update for jsoup, jsr-305 (important)
2022-04-19 00:00:00
github
github
Uncaught Exception in jsoup
2021-08-23 19:42:38
ubuntucve
ubuntucve
CVE-2021-37714
2021-08-18 00:00:00
nvd
nvd
CVE-2021-37714
2021-08-18 15:15:08
debiancve
debiancve
CVE-2021-37714
2021-08-18 15:15:08
cbl_mariner
cbl_mariner
CVE-2021-37714 affecting package jsoup 1.11.3-3
2024-07-03 03:08:37
redhat
redhat
(RHSA-2021:4676) Moderate: Red Hat JBoss Enterprise Application Platform 7.4.2 security update on RHEL 7
2021-11-15 16:54:28
(RHSA-2021:4677) Moderate: Red Hat JBoss Enterprise Application Platform 7.4.2 security update on RHEL 8
2021-11-15 16:54:31
(RHSA-2021:5154) Moderate: Red Hat JBoss Enterprise Application Platform 7.3.10 security update
2021-12-15 14:37:22
oracle
oracle
Oracle Critical Patch Update Advisory - October 2023
2023-10-17 00:00:00
Oracle Critical Patch Update Advisory - July 2022
2022-07-19 00:00:00
Oracle Critical Patch Update Advisory - January 2022
2022-01-18 00:00:00

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.009 Low

EPSS

Percentile

82.9%

JSON
Related for 2641B803CC5B6F698F27A4349942ABEEE0A931F1864DAEF1CB72FDFD279085E2
ibm9cvelist1nessus13osv2prion1redhatcve1atlassian1cve1vaadin1openvas2veracode1suse1github1ubuntucve1nvd1debiancve1cbl_mariner1redhat14oracle4