Skip to content

Release version 1.5.11

Compare
Choose a tag to compare
@davewichers davewichers released this 24 Nov 16:44

This release upgrades dependency httpclient to 4.5.13 to address CVE-2020-13956 in this library.

We note that there is also a known vulnerability (CVE-2020-14338) in xercesImpl:2.12.0 but Apache has not released an update to this library yet to eliminate it. We analyzed this CVE and determined that it does NOT affect AntiSamy. However, if you still want to eliminate this CVE, then you can exclude the version used by AntiSamy and use the version patched by JBoss described here: https://mvnrepository.com/artifact/xerces/xercesImpl/2.12.0.SP03. This will require you to do add the JBoss Maven repo to your pom. Alternately, you can upgrade to the patched version released by Apache when that becomes available.

This release also fixes this low risk (phishing) security issue described here:
#48 (Default URL regex allows URL starting with // to jump out of origin domain)

The release also includes some minor code cleanup and various dependency/plugin upgrades that were available.