Debian Package Tracker
Register | Log in
Subscribe

jsoup

Choose email to subscribe with

general
  • source: jsoup (main)
  • version: 1.15.3-1
  • maintainer: Debian Java Maintainers (archive) (DMD)
  • uploaders: Torsten Werner [DMD] – Jakub Adam [DMD] – Emmanuel Bourg [DMD] – Mechtilde Stehmann [DMD]
  • arch: all
  • std-ver: 4.6.1
  • VCS: Git (Browse, QA)
versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]
[pool directory]
  • o-o-stable: 1.10.2-2
  • oldstable: 1.10.2-2
  • old-bpo: 1.14.3-1~bpo11+1
  • stable: 1.15.3-1
  • testing: 1.15.3-1
  • unstable: 1.15.3-1
versioned links
  • 1.10.2-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 1.14.3-1~bpo11+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 1.15.3-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
binaries
  • libjsoup-java
  • libjsoup-java-doc
action needed
A new upstream version is available: 1.16.1 high
A new upstream version 1.16.1 is available, you should consider packaging it.
Created: 2023-02-22 Last update: 2023-09-30 12:34
Does not build reproducibly during testing normal
A package building reproducibly enables third parties to verify that the source matches the distributed binaries. It has been identified that this source package produced different results, failed to build or had other issues in a test environment. Please read about how to improve the situation!
Created: 2022-12-21 Last update: 2023-09-30 14:39
Multiarch hinter reports 1 issue(s) normal
There are issues with the multiarch metadata for this package.
  • libjsoup-java could be marked Multi-Arch: foreign
Created: 2016-09-14 Last update: 2023-09-30 12:37
lintian reports 7 warnings normal
Lintian reports 7 warnings about this package. You should make the package lintian clean getting rid of them.
Created: 2021-10-23 Last update: 2023-02-17 00:37
2 low-priority security issues in bullseye low

There are 2 open security issues in bullseye.

2 issues left for the package maintainer to handle:
  • CVE-2021-37714: (needs triaging) jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck (loop indefinitely until cancelled), to complete more slowly than usual, or to throw an unexpected exception. This effect may support a denial of service attack. The issue is patched in version 1.14.2. There are a few available workarounds. Users may rate limit input parsing, limit the size of inputs based on system resources, and/or implement thread watchdogs to cap and timeout parse runtimes.
  • CVE-2022-36033: (needs triaging) jsoup is a Java HTML parser, built for HTML editing, cleaning, scraping, and cross-site scripting (XSS) safety. jsoup may incorrectly sanitize HTML including `javascript:` URL expressions, which could allow XSS attacks when a reader subsequently clicks that link. If the non-default `SafeList.preserveRelativeLinks` option is enabled, HTML including `javascript:` URLs that have been crafted with control characters will not be sanitized. If the site that this HTML is published on does not set a Content Security Policy, an XSS attack is then possible. This issue is patched in jsoup 1.15.3. Users should upgrade to this version. Additionally, as the unsanitized input may have been persisted, old content should be cleaned again using the updated version. To remediate this issue without immediately upgrading: - disable `SafeList.preserveRelativeLinks`, which will rewrite input URLs as absolute URLs - ensure an appropriate [Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) is defined. (This should be used regardless of upgrading, as a defence-in-depth best practice.)

You can find information about how to handle these issues in the security team's documentation.

Created: 2022-07-04 Last update: 2023-06-11 06:30
Standards version of the package is outdated. wishlist
The package should be updated to follow the last version of Debian Policy (Standards-Version 4.6.2 instead of 4.6.1).
Created: 2022-12-17 Last update: 2022-12-17 19:18
news
[rss feed]
  • [2022-09-05] jsoup 1.15.3-1 MIGRATED to testing (Debian testing watch)
  • [2022-09-04] Accepted jsoup 1.15.3-1 (source) into unstable (Markus Koschany)
  • [2022-08-28] jsoup 1.15.2-1 MIGRATED to testing (Debian testing watch)
  • [2022-08-23] Accepted jsoup 1.15.2-1 (source) into unstable (Markus Koschany)
  • [2022-05-29] jsoup 1.15.1-1 MIGRATED to testing (Debian testing watch)
  • [2022-05-23] Accepted jsoup 1.15.1-1 (source) into unstable (Markus Koschany)
  • [2022-01-11] Accepted jsoup 1.14.3-1~bpo11+1 (source all) into bullseye-backports, bullseye-backports (Debian FTP Masters) (signed by: Markus Koschany)
  • [2021-10-17] jsoup 1.14.3-1 MIGRATED to testing (Debian testing watch)
  • [2021-10-11] Accepted jsoup 1.14.3-1 (source) into unstable (Markus Koschany)
  • [2021-09-14] jsoup 1.14.2-1 MIGRATED to testing (Debian testing watch)
  • [2021-09-09] Accepted jsoup 1.14.2-1 (source) into unstable (Markus Koschany)
  • [2021-05-02] Accepted jsoup 1.13.1-1 (source) into experimental (Markus Koschany)
  • [2020-01-26] Accepted jsoup 1.8.1-1+deb8u1 (source all) into oldoldstable (Thorsten Alteholz)
  • [2018-04-20] jsoup 1.10.2-2 MIGRATED to testing (Debian testing watch)
  • [2018-04-14] Accepted jsoup 1.10.2-2 (source) into unstable (Markus Koschany)
  • [2017-01-16] jsoup 1.10.2-1 MIGRATED to testing (Debian testing watch)
  • [2017-01-06] Accepted jsoup 1.10.2-1 (source all) into unstable (Emmanuel Bourg)
  • [2016-11-04] jsoup 1.10.1-1 MIGRATED to testing (Debian testing watch)
  • [2016-10-29] Accepted jsoup 1.10.1-1 (source all) into unstable (Emmanuel Bourg)
  • [2016-05-27] jsoup 1.9.2-1 MIGRATED to testing (Debian testing watch)
  • [2016-05-20] Accepted jsoup 1.9.2-1 (source all) into unstable (Emmanuel Bourg)
  • [2016-04-23] jsoup 1.9.1-1 MIGRATED to testing (Debian testing watch)
  • [2016-04-17] Accepted jsoup 1.9.1-1 (source all) into unstable (Emmanuel Bourg)
  • [2015-09-04] jsoup 1.8.3-1 MIGRATED to testing (Britney)
  • [2015-08-29] Accepted jsoup 1.8.3-1 (source all) into unstable (Emmanuel Bourg)
  • [2015-05-05] jsoup 1.8.2-1 MIGRATED to testing (Britney)
  • [2015-04-29] Accepted jsoup 1.8.2-1 (source all) into unstable (Emmanuel Bourg)
  • [2014-10-31] jsoup 1.8.1-1 MIGRATED to testing (Britney)
  • [2014-10-21] Accepted jsoup 1.8.1-1 (source all) into unstable (Emmanuel Bourg)
  • [2013-12-01] jsoup 1.7.3-1 MIGRATED to testing (Debian testing watch)
  • 1
  • 2
bugs [bug history graph]
  • all: 0
links
  • homepage
  • lintian (0, 7)
  • buildd: logs, reproducibility
  • popcon
  • browse source code
  • edit tags
  • other distros
  • security tracker
ubuntu Ubuntu logo [Information about Ubuntu for Debian Developers]
  • version: 1.15.3-1

Debian Package Tracker — Copyright 2013-2018 The Distro Tracker Developers
Report problems to the tracker.debian.org pseudo-package in the Debian BTS.
Documentation — Bugs — Git Repository — Contributing