VulnerabilityModified
CVE-2022-34169
The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets.
HIGH 7.5EPSS 81.0%
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 81.0%, higher than 100% of all known CVEs. Patch or mitigate before the next change window.
Description
The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 or later. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- EPSS
- 81.04% probability · 100th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-681
- Affected
- apache/xalan-java · debian/debian linux · oracle/graalvm · oracle/jdk · oracle/jre · oracle/openjdk · fedoraproject/fedora · netapp/7-mode transition tool · netapp/active iq unified manager · netapp/cloud insights acquisition unit · netapp/cloud secure agent · netapp/hci management node · netapp/oncommand insight · netapp/solidfire · netapp/hci compute node · azul/zulu
- Source
- security@apache.org
References
- http://packetstormsecurity.com/files/168186/Xalan-J-XSLTC-Integer-Truncation.htmlThird Party Advisory, VDB Entry
- http://www.openwall.com/lists/oss-security/2022/07/19/5Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2022/07/19/6Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2022/07/20/2Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2022/07/20/3Mailing List, Patch, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2022/10/18/2Mailing List, Patch, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2022/11/04/8Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2022/11/07/2Mailing List, Third Party Advisory
- https://lists.apache.org/thread/12pxy4phsry6c34x2ol4fft6xlho4kywIssue Tracking, Mailing List, Vendor Advisory
- https://lists.apache.org/thread/2qvl7r43wb4t8p9dd9om1bnkssk07sn8Issue Tracking, Mailing List, Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2022/10/msg00024.htmlMailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H4YNJSJ64NPCNKFPNBYITNZU5H3L4D6L/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5OZNAZJ4YHLOKRRRZSWRT5OJ25E4XLM/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN3EVGR7FD3ZLV5SBTJXUIDCMSK4QUE2/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KO3DXNKZ4EU3UZBT6AAR4XRKCD73KLMO/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3XPOTPPBZIPFBZHQE5E7OW6PDACUMCJ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YULPNO3PAWMEQQZV2C54I3H3ZOXFZUTB/
- https://security.gentoo.org/glsa/202401-25
- https://security.netapp.com/advisory/ntap-20220729-0009/Third Party Advisory
- https://security.netapp.com/advisory/ntap-20240621-0006/
- https://www.debian.org/security/2022/dsa-5188Third Party Advisory
- https://www.debian.org/security/2022/dsa-5192Third Party Advisory
- https://www.debian.org/security/2022/dsa-5256Third Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.htmlPatch, Third Party Advisory
- http://packetstormsecurity.com/files/168186/Xalan-J-XSLTC-Integer-Truncation.htmlThird Party Advisory, VDB Entry
- http://www.openwall.com/lists/oss-security/2022/07/19/5Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2022/07/19/6Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2022/07/20/2Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2022/07/20/3Mailing List, Patch, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2022/10/18/2Mailing List, Patch, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.