CVE-2022-34169
Published: 19 July 2022
The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 or later. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.
Notes
Author | Note |
---|---|
leosilva | bug is mostly in bcel and java. There is no fix in xalan what leosilva> it seems. |
Priority
Status
Package | Release | Status |
---|---|---|
icedtea-web Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
|
focal |
Not vulnerable
|
|
jammy |
Not vulnerable
|
|
upstream |
Not vulnerable
|
|
xenial |
Not vulnerable
|
|
kinetic |
Not vulnerable
|
|
lunar |
Not vulnerable
|
|
trusty |
Does not exist
|
|
impish |
Ignored
(end of life)
|
|
libxalan2-java Launchpad, Ubuntu, Debian |
kinetic |
Ignored
(end of life, was needs-triage)
|
lunar |
Needs triage
|
|
trusty |
Needs triage
|
|
xenial |
Needs triage
|
|
bionic |
Needs triage
|
|
focal |
Needs triage
|
|
jammy |
Needs triage
|
|
upstream |
Needs triage
|
|
impish |
Ignored
(end of life)
|
|
openjdk-12 Launchpad, Ubuntu, Debian |
kinetic |
Does not exist
|
lunar |
Does not exist
|
|
trusty |
Does not exist
|
|
xenial |
Does not exist
|
|
bionic |
Does not exist
|
|
focal |
Does not exist
|
|
impish |
Does not exist
|
|
jammy |
Does not exist
|
|
upstream |
Needs triage
|
|
openjdk-13 Launchpad, Ubuntu, Debian |
kinetic |
Does not exist
|
lunar |
Does not exist
|
|
trusty |
Does not exist
|
|
xenial |
Does not exist
|
|
bionic |
Does not exist
|
|
impish |
Does not exist
|
|
jammy |
Does not exist
|
|
upstream |
Needs triage
|
|
focal |
Ignored
(superseded by openjdk-17)
|
|
openjdk-15 Launchpad, Ubuntu, Debian |
kinetic |
Does not exist
|
lunar |
Does not exist
|
|
trusty |
Does not exist
|
|
xenial |
Does not exist
|
|
bionic |
Does not exist
|
|
focal |
Does not exist
|
|
impish |
Does not exist
|
|
jammy |
Does not exist
|
|
upstream |
Needs triage
|
|
openjdk-16 Launchpad, Ubuntu, Debian |
kinetic |
Does not exist
|
lunar |
Does not exist
|
|
trusty |
Does not exist
|
|
xenial |
Does not exist
|
|
bionic |
Does not exist
|
|
jammy |
Does not exist
|
|
upstream |
Needs triage
|
|
impish |
Ignored
(end of life)
|
|
focal |
Ignored
(superseded by openjdk-17)
|
|
openjdk-17 Launchpad, Ubuntu, Debian |
jammy |
Released
(17.0.4+8-1~22.04)
|
kinetic |
Released
(17.0.4+8-1)
|
|
lunar |
Not vulnerable
(17.0.4+8-1)
|
|
trusty |
Does not exist
|
|
upstream |
Needs triage
|
|
xenial |
Does not exist
|
|
impish |
Ignored
(end of life)
|
|
bionic |
Released
(17.0.4+8-1~18.04)
|
|
focal |
Released
(17.0.4+8-1~20.04)
|
|
openjdk-18 Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
focal |
Does not exist
|
|
impish |
Ignored
(end of life)
|
|
jammy |
Released
(18.0.2+9-2~22.04)
|
|
kinetic |
Released
(18.0.2+9-2)
|
|
lunar |
Not vulnerable
(18.0.2+9-2)
|
|
trusty |
Does not exist
|
|
upstream |
Needs triage
|
|
xenial |
Does not exist
|
|
openjdk-8 Launchpad, Ubuntu, Debian |
focal |
Released
(8u342-b07-0ubuntu1~20.04)
|
kinetic |
Not vulnerable
(8u342-b07-1)
|
|
lunar |
Not vulnerable
(8u342-b07-1)
|
|
trusty |
Does not exist
|
|
upstream |
Needs triage
|
|
impish |
Ignored
(end of life)
|
|
bionic |
Released
(8u342-b07-0ubuntu1~18.04)
|
|
jammy |
Released
(8u342-b07-0ubuntu1~22.04)
|
|
xenial |
Released
(8u342-b07-0ubuntu1~16.04)
Available with Ubuntu Pro or Ubuntu Pro (Infra-only) |
|
openjdk-9 Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
focal |
Does not exist
|
|
impish |
Does not exist
|
|
jammy |
Does not exist
|
|
kinetic |
Does not exist
|
|
lunar |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Needs triage
|
|
xenial |
Ignored
(no longer supported by upstream)
|
|
openjdk-lts Launchpad, Ubuntu, Debian |
bionic |
Released
(11.0.16+8-0ubuntu1~18.04)
|
focal |
Released
(11.0.16+8-0ubuntu1~20.04)
|
|
impish |
Ignored
(end of life)
|
|
jammy |
Released
(11.0.16+8-0ubuntu1~22.04)
|
|
kinetic |
Released
(11.0.16+8-0ubuntu1)
|
|
lunar |
Released
(11.0.16+8-0ubuntu1)
|
|
trusty |
Does not exist
|
|
upstream |
Needs triage
|
|
xenial |
Does not exist
|
Severity score breakdown
Parameter | Value |
---|---|
Base score | 7.5 |
Attack vector | Network |
Attack complexity | Low |
Privileges required | None |
User interaction | None |
Scope | Unchanged |
Confidentiality | None |
Integrity impact | High |
Availability impact | None |
Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
References
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34169
- https://lists.apache.org/thread/12pxy4phsry6c34x2ol4fft6xlho4kyw
- https://lists.apache.org/thread/2qvl7r43wb4t8p9dd9om1bnkssk07sn8
- https://marc.info/?l=oss-security&m=165825217622132
- https://openjdk.org/groups/vulnerability/advisories/2022-07-19
- https://github.com/openjdk/jdk/commit/41ef2b249073450172e11163a4d05762364b1297
- https://ubuntu.com/security/notices/USN-5546-1
- https://ubuntu.com/security/notices/USN-5546-2
- NVD
- Launchpad
- Debian