Advisory ROSA-SA-2023-2239

software: batik 1.11
WASP: ROSA-CHROME

package_evr_string: batik-1.11-3.src.rpm

CVE-ID: CVE-2019-17566
BDU-ID: None
CVE-Crit: HIGH
CVE-DESC.: Apache Batik is vulnerable to server-side request forgery caused by improper input validation using “xlink:href” attributes. Using a specially crafted argument, an attacker could exploit this vulnerability to force the underlying server to execute arbitrary GET requests.
CVE-STATUS: Fixed
CVE-REV: To close, run the command: sudo dnf update batik

CVE-ID: CVE-2022-41704
BDU-ID: 2022-06660
CVE-Crit: HIGH
CVE-DESC.: A vulnerability in the Apache Batik SVG image manipulation library is related to insufficient validation of incoming requests. Exploitation of the vulnerability could allow an attacker acting remotely to execute arbitrary Java code
CVE-STATUS: Fixed
CVE-REV: To close, run the command: sudo dnf update batik

CVE-ID: CVE-2022-42890
BDU-ID: 2022-06659
CVE-Crit: HIGH
CVE-DESC.: A vulnerability in the Apache Batik SVG image manipulation library is related to insufficient validation of incoming requests. Exploitation of the vulnerability could allow an attacker acting remotely to execute arbitrary Java code
CVE-STATUS: Fixed
CVE-REV: To close, run the command: sudo dnf update batik