-------------------------------------------------------------------------
Debian LTS Advisory DLA-4246-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Markus Koschany
July 22, 2025 https://wiki.debian.org/LTS
-------------------------------------------------------------------------
Package : libowasp-esapi-java
Version : 2.4.0.0-0+deb11u1
CVE ID : CVE-2022-23457 CVE-2022-24891 CVE-2025-5878
Debian Bug : 1010339 1109378
Several security vulnerabilities have been discovered in libowasp-esapi-java,
a Java Enterprise Security API.
CVE-2022-23457:
ESAPI (The OWASP Enterprise Security API) is a free, open source, web
application security control library. Prior to this update the default
implementation of `Validator.getValidDirectoryPath(String, String, File,
boolean)` may incorrectly treat the tested input string as a child of the
specified parent directory. This potentially could allow control-flow
bypass checks to be defeated if an attack can specify the entire string
representing the 'input' path.
CVE-2022-24891:
There is a potential for a cross-site scripting vulnerability in ESAPI
caused by a incorrect regular expression for "onsiteURL" in the
**antisamy-esapi.xml** configuration file that can cause "javascript:" URLs
to fail to be correctly sanitized.
CVE-2025-5878:
This issue affects the interface Encoder.encodeForSQL of the
SQL Injection Defense. An attack leads to an improper neutralization of
special elements. We are not aware of any affected reverse-dependencies in
Debian but if you use ESAPI in a stand-alone project, you should be aware
that the Encoder.encodeForSQL method has been deprecated and will be
removed eventually. In addition the DB2Codec, MySQLCodec and OracleCodec
classes have been deprecated too. We recommend to carefully assess if
your project might be affected by these classes and methods and if you have
to implement additional steps to secure your application. The update does
not automatically protect you from any potential risks.
For Debian 11 bullseye, these problems have been fixed in version
2.4.0.0-0+deb11u1.
We recommend that you upgrade your libowasp-esapi-java packages.
For the detailed security status of libowasp-esapi-java please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/libowasp-esapi-java
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
Attachment:
signature.asc
Description: This is a digitally signed message part