Skip to content

Release version 1.6.7
Compare
Choose a tag to compare
@davewichers davewichers released this 13 Apr 22:11
· 473 commits to main since this release
v1.6.7
a42865c
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.

This release addresses a minor issue in the security fixes implemented in 1.6.6. While those fixes addressed most of the security concerns in the security issue reported to us by the researcher, our fix had a minor bug that allowed something to sneak through. This release fixes that, and includes the changes from 1.6.6.1 that compile AntiSamy.jar to Java 7 bytecode.

It specifically addresses CVE-2022-29577, which is the complete fix to: CVE-2022-28367: AntiSamy before 1.6.6 allows XSS via HTML tag smuggling on STYLE content. - https://www.cvedetails.com/cve/CVE-2022-29577.

Assets 2