CVE-2022-29577
Fixed upstream EPSS 1%
OWASP AntiSamy before 1.6.7 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content. NOTE: this issue exists because of an incomplete fix for CVE-2022-28367.
Products: antisamy_project antisamy, oracle enterprise_manager_base_platform, oracle weblogic_server
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.owasp.antisamy:antisamy | 1.6.7 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu 16.04 LTS | libowasp-antisamy-java | no fix |
| Ubuntu 18.04 LTS | libowasp-antisamy-java | no fix |
| Ubuntu 20.04 LTS | libowasp-antisamy-java | no fix |
| Ubuntu 22.04 LTS | libowasp-antisamy-java | no fix |
| Ubuntu 24.04 LTS | libowasp-antisamy-java | no fix |
| Ubuntu 25.10 | libowasp-antisamy-java | no fix |
| Ubuntu 26.04 LTS | libowasp-antisamy-java | no fix |
| Ubuntu 26.10 | libowasp-antisamy-java | no fix |