Hi,

The following vulnerability was published for libowasp-antisamy-java.

CVE-2024-23635[0]:
| AntiSamy is a library for performing fast, configurable cleansing of
| HTML coming from untrusted sources. Prior to 1.7.5, there is a
| potential for a mutation XSS (mXSS) vulnerability in AntiSamy caused
| by flawed parsing of the HTML being sanitized. To be subject to this
| vulnerability the `preserveComments` directive must be enabled in
| your policy file. As a result, certain crafty inputs can result in
| elements in comment tags being interpreted as executable when using
| AntiSamy's sanitized output. Patched in AntiSamy 1.7.5 and later.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2024-23635
https://www.cve.org/CVERecord?id=CVE-2024-23635
[1] https://github.com/nahsra/antisamy/security/advisories/GHSA-2mrq-w8pv-5pvq

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
libowasp-antisamy-java, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1062846@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Emmanuel Bourg <ebourg@apache.org> (supplier of updated libowasp-antisamy-java package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Tue, 27 Oct 2026 09:11:31 +0100
Source: libowasp-antisamy-java
Architecture: source
Version: 1.7.8-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org>
Changed-By: Emmanuel Bourg <ebourg@apache.org>
Closes: 1062846
Changes:
 libowasp-antisamy-java (1.7.8-1) unstable; urgency=medium
 .
   * Team upload.
   * New upstream release
     - Fixes CVE-2024-23635 (Closes: #1062846)
     - Refreshed the patches
   * Standards-Version updated to 4.7.4
   * Removed the unused dependency on libcommons-io-java
   * Removed the dependency on libjaxp1.3-java
   * Removed the Priority field
   * Converted debian/watch to the version 5 format
Checksums-Sha1:
 838c4df08bcd27cd62eb03ae01a8dd27067a75bc 2230 libowasp-antisamy-java_1.7.8-1.dsc
 ec16070de6b5208c1828078c24843df32e861b8b 3168484 libowasp-antisamy-java_1.7.8.orig.tar.xz
 aefc6557fa35986b7dfcc2c35573aa1598803484 5544 libowasp-antisamy-java_1.7.8-1.debian.tar.xz
 236d227b145dd58f63812c6f7083cae135eabe0c 15445 libowasp-antisamy-java_1.7.8-1_source.buildinfo
Checksums-Sha256:
 c0bb25dde2ad202298a70730193878c78d2b51ef496f7e5d7d9413483b8e8800 2230 libowasp-antisamy-java_1.7.8-1.dsc
 46a2a06452f2ee7365b2e6ebcaf1e67704d2906a6883b2e6549e40fdc74ef4cb 3168484 libowasp-antisamy-java_1.7.8.orig.tar.xz
 a5b937fedef43824c11e91353df5a1d4f58d6e03ae83797c2abea438feebd62d 5544 libowasp-antisamy-java_1.7.8-1.debian.tar.xz
 96593f30ad15b5ab136f5f0a7da936a56d3e89a705ff42436dd9bc997ae697c3 15445 libowasp-antisamy-java_1.7.8-1_source.buildinfo
Files:
 901b9b15123685fc953452000596d27f 2230 java optional libowasp-antisamy-java_1.7.8-1.dsc
 ae66d404ccdc583ab58d8077f1c623d4 3168484 java optional libowasp-antisamy-java_1.7.8.orig.tar.xz
 319d72917e8089e070bac6e896eb7344 5544 java optional libowasp-antisamy-java_1.7.8-1.debian.tar.xz
 573af0854fc9c9add3af89b676e27a74 15445 java optional libowasp-antisamy-java_1.7.8-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQJGBAEBCgAwFiEEuM5N4hCA3PkD4WxA9RPEGeS50KwFAmrgXRMSHGVib3VyZ0Bh
cGFjaGUub3JnAAoJEPUTxBnkudCsMqkP/RB8Ne2oNXOPPT8sYQRt8V063YUGXXNk
wdses3PrELjd35gF5ZxtomkVisctUsT/Htuh5N8kpHebMG2lvTMGQ6f5bi5t1T5A
/j9ob5tmgzowvqIlyq3dKe3R3vETiGkmXaHw5cwzilNkjxkw7sEajqjCK7d6shNO
IDAkEhX1qt5IhoqzEA3FtBEqzXjD9KhSAzw40tUtlmkOqiSN+KrhonT7IRJ1GGRn
cgEkne8uEp8kGdj2vyDURLedGqi10Qa7re3a+wt0lYNOcYReUIGZy0bG6lJ+dGBN
sFS23YNdJDK75vHSIfQBus1k22tKbdAAiL3GCtJ5SmO5QH3OERt/fJJ0uU6ad5pr
dS/QnX46iJIPQsHhMv0RtDujAfkUoB5495A3P8sjeG2x4HjvmGoRnttJW+z7XLoM
OY+W3q/jwbO99ZbgB45WkLSfvQVok9oA9hKsXubzRReQS9I54q47wGgvUEGpOe9g
blTvuPP4MUXWkLMp2+EIdWGJOTpnFyb8aqs96ILORzMVoUJvPaOjinJ6BLVZfz9C
ZkYl6wvXBoAzlEc8CmJn5N99JndCbZQF576eplf8Ud0y3XVAryrAf95tPsOIOFw1
DW9OIwb1aZaAHJkJXocZplOcZU9YpMK42nDN15anMWsmKl4VFiYAc4N+LihnUfz2
ZTSHlW1kIhVH
=fUtT
-----END PGP SIGNATURE-----