{"id":"CVE-2021-42575","aliases":["EUVD-2021-2151","GHSA-3w73-fmf3-hg5c","RHSA-2022:7409","RHSA-2022:7410","RHSA-2022:7411"],"status":"published","title":"Policies not properly enforced in OWASP Java HTML Sanitizer","description":"The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.02975,"percentile":0.87372,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2021-10-18T14:38:13Z","modified":"2026-10-13T10:03:28Z","fixes":[{"ecosystem":"Maven","package":"com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer","fixed_in":["20211018.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20211018.1"}]}]},{"source":"osv","ecosystem":"Maven","package":"com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20211018.1"}]}],"versions":["1.1","20150501.1","20151202.2","20160203.1","20160413.1","20160422.1","20160526.1","20160614.1","20160628.1","20160827.1","20160924.1","20170329.1","20170408.1","20170411.1","20170512.1","20170515.1","20171016.1","20180219.1","20181114.1","20190325.1","20190503.1","20190610.1","20191001.1","20200615.1","20200713.1","r136","r156","r163","r164","r173","r198","r209","r223","r232","r239"]},{"source":"osv","ecosystem":"Red Hat:red_hat_single_sign_on:7.6::el7","package":"rh-sso7-keycloak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.0.3-1.redhat_00001.1.el7sso"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:red_hat_single_sign_on:7.6::el7","package":"rh-sso7-keycloak-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.0.3-1.redhat_00001.1.el7sso"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:red_hat_single_sign_on:7.6::el8","package":"rh-sso7-keycloak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.0.3-1.redhat_00001.1.el8sso"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:red_hat_single_sign_on:7.6::el8","package":"rh-sso7-keycloak-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.0.3-1.redhat_00001.1.el8sso"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:red_hat_single_sign_on:7.6::el9","package":"rh-sso7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1-5.el9sso"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:red_hat_single_sign_on:7.6::el9","package":"rh-sso7-javapackages-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.0-7.el9sso"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:red_hat_single_sign_on:7.6::el9","package":"rh-sso7-javapackages-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.0-7.el9sso"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:red_hat_single_sign_on:7.6::el9","package":"rh-sso7-keycloak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.0.3-1.redhat_00001.1.el9sso"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:red_hat_single_sign_on:7.6::el9","package":"rh-sso7-keycloak-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.0.3-1.redhat_00001.1.el9sso"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:red_hat_single_sign_on:7.6::el9","package":"rh-sso7-python3-javapackages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.0-7.el9sso"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:red_hat_single_sign_on:7.6::el9","package":"rh-sso7-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1-5.el9sso"}]}],"bundled":11}],"products":[{"vendor":"oracle","product":"middleware_common_libraries_and_tools"},{"vendor":"oracle","product":"primavera_unifier"},{"vendor":"owasp","product":"java_html_sanitizer"}],"references":[{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","web"]},{"url":"https://docs.google.com/document/d/11SoX296sMS0XoQiQbpxc5pNxSdbJKDJkm5BDv0zrX50/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-42575","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-3w73-fmf3-hg5c"},{"url":"https://docs.google.com/document/d/11SoX296sMS0XoQiQbpxc5pNxSdbJKDJkm5BDv0zrX50","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2022:7409","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2031958","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2039403","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2040268","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2060929","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2064226","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2064698","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2115392","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_7409.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-36518","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-36518","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-36518","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-57j2-w4cx-62h2","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-42392","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-42392","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-42392","tags":["advisory"]},{"url":"https://github.com/h2database/h2database/security/advisories/GHSA-h376-j262-vhq6","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-42575","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2027195","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-42575","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-43797","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-43797","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-43797","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-wx5j-54mm-rqqq","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-0084","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-0084","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0084","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-0225","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-0225","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0225","tags":["advisory"]},{"url":"https://github.com/keycloak/keycloak/security/advisories/GHSA-755v-r4x4-qf7m","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-0853","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2060725","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-0853","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0853","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-0866","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-0866","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0866","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-1319","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2073890","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-1319","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1319","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-2668","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-2668","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-2668","tags":["advisory"]},{"url":"https://github.com/keycloak/keycloak/security/advisories/GHSA-wf7g-7h6h-678v","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-23913","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2063601","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-23913","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23913","tags":["advisory"]},{"url":"https://lists.apache.org/thread/fjynj57rd99s814rdn5hzvmx8lz403q2","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2022:7410","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_7410.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:7411","tags":["advisory"]},{"url":"https://access.redhat.com/articles/11258","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_7411.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-42575","description":"The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.","status":"published","published":"2021-10-18T14:38:13Z","modified":"2024-08-04T03:38:49.294Z","updated_at":"2026-11-02T14:32:58.739039Z"}],"euvd":[{"id":"EUVD-2021-2151","description":"The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.","status":"published","published":"2021-10-18T14:38:13Z","modified":"2024-08-04T03:38:49Z","updated_at":"2026-11-03T03:24:15.755984Z"}],"ghsa":[{"id":"GHSA-3w73-fmf3-hg5c","title":"Policies not properly enforced in OWASP Java HTML Sanitizer","description":"The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the `SELECT`, `STYLE`, and `OPTION` elements.","status":"published","published":"2021-10-19T20:15:50Z","modified":"2023-01-27T05:02:20Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:36:17.742171Z"}],"nvd":[{"id":"CVE-2021-42575","description":"The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.","status":"published","published":"2021-10-18T15:15:07.78Z","modified":"2026-06-17T04:09:51.163Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:06:59.689345Z"}],"osv":[{"id":"GHSA-3w73-fmf3-hg5c","title":"Policies not properly enforced in OWASP Java HTML Sanitizer","description":"The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the `SELECT`, `STYLE`, and `OPTION` elements.","status":"published","published":"2021-10-19T20:15:50Z","modified":"2024-02-19T05:33:53.630019Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:36.092962Z"},{"id":"RHSA-2022:7409","title":"Red Hat Security Advisory: Red Hat Single Sign-On 7.6.1 security update on RHEL 7","status":"published","published":"2024-09-29T19:07:31Z","modified":"2026-10-13T10:03:28Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RHSA-2022:7410","title":"Red Hat Security Advisory: Red Hat Single Sign-On 7.6.1 security update on RHEL 8","status":"published","published":"2024-09-29T19:07:15Z","modified":"2026-10-13T10:03:28Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RHSA-2022:7411","title":"Red Hat Security Advisory: Red Hat Single Sign-On 7.6.1 security update on RHEL 9","status":"published","published":"2024-09-29T19:07:39Z","modified":"2026-10-13T10:03:28Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:10.139266Z"}]}}