Lucene search

ApacheCVE-2022-34169

HistoryJul 19, 2022 - 6:15 p.m.

CVE-2022-34169

2022-07-1918:15:11

CWE-681

apache

web.nvd.nist.gov

483

apache

xalan

java

xslt

library

integer truncation

vulnerability

malicious

stylesheets

java bytecode

update

nvd

cve-2022-34169

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

AI Score

Confidence

High

EPSS

0.002

Percentile

53.3%

JSON

The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 or later. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.

Affected configurations

Nvd

Vulners

Node

apachexalan-javaRange≤2.7.2

Node

debiandebian_linuxMatch10.0

debiandebian_linuxMatch11.0

Node

oraclegraalvmMatch20.3.6enterprise

oraclegraalvmMatch21.3.2enterprise

oraclegraalvmMatch22.1.0enterprise

oraclejdkMatch1.7.0update343

oraclejdkMatch1.8.0update333

oraclejdkMatch11.0.15.1

oraclejdkMatch17.0.3.1

oraclejdkMatch18.0.1.1

oraclejreMatch1.7.0update343

oraclejreMatch1.8.0update333

oraclejreMatch11.0.15.1

oraclejreMatch17.0.3.1

oraclejreMatch18.0.1.1

Node

oracleopenjdkRange11–11.0.15

oracleopenjdkRange13–13.0.11

oracleopenjdkRange15–15.0.7

oracleopenjdkRange17–17.0.3

oracleopenjdkMatch7-

oracleopenjdkMatch7update1

oracleopenjdkMatch7update10

oracleopenjdkMatch7update101

oracleopenjdkMatch7update11

oracleopenjdkMatch7update111

oracleopenjdkMatch7update121

oracleopenjdkMatch7update13

oracleopenjdkMatch7update131

oracleopenjdkMatch7update141

oracleopenjdkMatch7update15

oracleopenjdkMatch7update151

oracleopenjdkMatch7update161

oracleopenjdkMatch7update17

oracleopenjdkMatch7update171

oracleopenjdkMatch7update181

oracleopenjdkMatch7update191

oracleopenjdkMatch7update2

oracleopenjdkMatch7update201

oracleopenjdkMatch7update21

oracleopenjdkMatch7update211

oracleopenjdkMatch7update221

oracleopenjdkMatch7update231

oracleopenjdkMatch7update241

oracleopenjdkMatch7update25

oracleopenjdkMatch7update251

oracleopenjdkMatch7update261

oracleopenjdkMatch7update271

oracleopenjdkMatch7update281

oracleopenjdkMatch7update291

oracleopenjdkMatch7update3

oracleopenjdkMatch7update301

oracleopenjdkMatch7update311

oracleopenjdkMatch7update321

oracleopenjdkMatch7update4

oracleopenjdkMatch7update40

oracleopenjdkMatch7update45

oracleopenjdkMatch7update5

oracleopenjdkMatch7update51

oracleopenjdkMatch7update55

oracleopenjdkMatch7update6

oracleopenjdkMatch7update60

oracleopenjdkMatch7update65

oracleopenjdkMatch7update67

oracleopenjdkMatch7update7

oracleopenjdkMatch7update72

oracleopenjdkMatch7update76

oracleopenjdkMatch7update80

oracleopenjdkMatch7update85

oracleopenjdkMatch7update9

oracleopenjdkMatch7update91

oracleopenjdkMatch7update95

oracleopenjdkMatch7update97

oracleopenjdkMatch7update99

oracleopenjdkMatch8-

oracleopenjdkMatch8milestone1

oracleopenjdkMatch8milestone2

oracleopenjdkMatch8milestone3

oracleopenjdkMatch8milestone4

oracleopenjdkMatch8milestone5

oracleopenjdkMatch8milestone6

oracleopenjdkMatch8milestone7

oracleopenjdkMatch8milestone8

oracleopenjdkMatch8milestone9

oracleopenjdkMatch8update101

oracleopenjdkMatch8update102

oracleopenjdkMatch8update11

oracleopenjdkMatch8update111

oracleopenjdkMatch8update112

oracleopenjdkMatch8update121

oracleopenjdkMatch8update131

oracleopenjdkMatch8update141

oracleopenjdkMatch8update151

oracleopenjdkMatch8update152

oracleopenjdkMatch8update161

oracleopenjdkMatch8update162

oracleopenjdkMatch8update171

oracleopenjdkMatch8update172

oracleopenjdkMatch8update181

oracleopenjdkMatch8update191

oracleopenjdkMatch8update192

oracleopenjdkMatch8update20

oracleopenjdkMatch8update201

oracleopenjdkMatch8update202

oracleopenjdkMatch8update211

oracleopenjdkMatch8update212

oracleopenjdkMatch8update221

oracleopenjdkMatch8update222

oracleopenjdkMatch8update231

oracleopenjdkMatch8update232

oracleopenjdkMatch8update241

oracleopenjdkMatch8update242

oracleopenjdkMatch8update25

oracleopenjdkMatch8update252

oracleopenjdkMatch8update262

oracleopenjdkMatch8update271

oracleopenjdkMatch8update281

oracleopenjdkMatch8update282

oracleopenjdkMatch8update291

oracleopenjdkMatch8update301

oracleopenjdkMatch8update302

oracleopenjdkMatch8update31

oracleopenjdkMatch8update312

oracleopenjdkMatch8update322

oracleopenjdkMatch8update332

oracleopenjdkMatch8update40

oracleopenjdkMatch8update45

oracleopenjdkMatch8update5

oracleopenjdkMatch8update51

oracleopenjdkMatch8update60

oracleopenjdkMatch8update65

oracleopenjdkMatch8update66

oracleopenjdkMatch8update71

oracleopenjdkMatch8update72

oracleopenjdkMatch8update73

oracleopenjdkMatch8update74

oracleopenjdkMatch8update77

oracleopenjdkMatch8update91

oracleopenjdkMatch8update92

oracleopenjdkMatch18

Node

fedoraprojectfedoraMatch35

fedoraprojectfedoraMatch36

Node

netapp7-mode_transition_toolMatch-

netappactive_iq_unified_managerMatch-vmware_vsphere

netappactive_iq_unified_managerMatch-windows

netappcloud_insights_acquisition_unitMatch-

netappcloud_secure_agentMatch-

netapphci_management_nodeMatch-

netapponcommand_insightMatch-

netappsolidfireMatch-

netapphci_compute_nodeMatch-

Node

azulzuluMatch6.47

azulzuluMatch7.54

azulzuluMatch8.62

azulzuluMatch11.56

azulzuluMatch13.48

azulzuluMatch15.40

azulzuluMatch17.34

azulzuluMatch18.30

VendorProductVersionCPE
apachexalan-java*cpe:2.3:a:apache:xalan-java:*:*:*:*:*:*:*:*
debiandebian_linux10.0cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
debiandebian_linux11.0cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
oraclegraalvm20.3.6cpe:2.3:a:oracle:graalvm:20.3.6:*:*:*:enterprise:*:*:*
oraclegraalvm21.3.2cpe:2.3:a:oracle:graalvm:21.3.2:*:*:*:enterprise:*:*:*
oraclegraalvm22.1.0cpe:2.3:a:oracle:graalvm:22.1.0:*:*:*:enterprise:*:*:*
oraclejdk1.7.0cpe:2.3:a:oracle:jdk:1.7.0:update343:*:*:*:*:*:*
oraclejdk1.8.0cpe:2.3:a:oracle:jdk:1.8.0:update333:*:*:*:*:*:*
oraclejdk11.0.15.1cpe:2.3:a:oracle:jdk:11.0.15.1:*:*:*:*:*:*:*
oraclejdk17.0.3.1cpe:2.3:a:oracle:jdk:17.0.3.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
apache	xalan-java	*	cpe:2.3:a:apache:xalan-java::::::::
debian	debian_linux	10.0	cpe:2.3:o:debian:debian_linux:10.0:::::::*
debian	debian_linux	11.0	cpe:2.3:o:debian:debian_linux:11.0:::::::*
oracle	graalvm	20.3.6	cpe:2.3:a:oracle:graalvm:20.3.6::::enterprise:::
oracle	graalvm	21.3.2	cpe:2.3:a:oracle:graalvm:21.3.2::::enterprise:::
oracle	graalvm	22.1.0	cpe:2.3:a:oracle:graalvm:22.1.0::::enterprise:::
oracle	jdk	1.7.0	cpe:2.3:a:oracle:jdk:1.7.0:update343::::::
oracle	jdk	1.8.0	cpe:2.3:a:oracle:jdk:1.8.0:update333::::::
oracle	jdk	11.0.15.1	cpe:2.3:a:oracle:jdk:11.0.15.1:::::::*
oracle	jdk	17.0.3.1	cpe:2.3:a:oracle:jdk:17.0.3.1:::::::*

Rows per page:

1-10 of 1561

CNA Affected

[
  {
    "product": "Apache Xalan-J",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "2.7.2",
        "status": "affected",
        "version": "Xalan-J",
        "versionType": "custom"
      }
    ]
  }
]