Security Bulletin: Vulnerabilities found in batik-bridge-1.7.jar which is shipped with IBM® Intelligent Operations Center(CVE-2022-40146, CVE-2022-38648, CVE-2022-38398)

Summary Multiple vulnerabilities have been identified in batik-bridge-1.7.jar which is shipped with IBM® Intelligent Operations Center. Information about these vulnerabilities affecting IBM® Intelligent Operations Center have been published and addressed the applicable CVEs. Vulnerability Details...

ai.tock:tock-shared (>=19.9.4, <=26.9.0), at.austriapro:ebinterface-rendering (>=1.0.0, <=1.0.1) +1996 more potentially affected by CVE-2022-44729 via org.apache.xmlgraphics:batik-bridge (>=1.6.1, <=1.16)

org.apache.xmlgraphics:batik-bridge MAVEN version =1.6.1, =19.9.4, =1.0.0, =1.0.7, =1.10.2, =1.13.0, =0.1.1, =0.5.0, =0.11.1, =0.0.2, =0.2.1 - berlin.softwaretechnik:geojsonrenderer2.13 0.0.1 - bio.ferlab:obo-parser2.12 1.3.1 and more Source cves: CVE-2022-44729 Source advisory: GHSA-GQ5F-XV48-23...

ai.tock:tock-shared (>=19.9.4, <=26.9.0), at.austriapro:ebinterface-rendering (>=1.0.0, <=1.0.1) +1996 more potentially affected by CVE-2022-44729 via org.apache.xmlgraphics:batik-bridge (>=1.6.1, <=1.16)

org.apache.xmlgraphics:batik-bridge MAVEN version =1.6.1, =19.9.4, =1.0.0, =1.0.7, =1.10.2, =1.13.0, =0.1.1, =0.5.0, =0.11.1, =0.0.2, =0.2.1 - berlin.softwaretechnik:geojsonrenderer2.13 0.0.1 - bio.ferlab:obo-parser2.12 1.3.1 and more Source cves: CVE-2022-44729 Source advisory: MEND:CVE-2022-447...

Information Disclosure

Batik bridge is vulnerable to information disclosure. The vulnerability exists in the function of DefaultScriptSecurity because the jars get loaded by default which allows an attacker to execute arbitrary codes into the system...

ai.tock:tock-shared (>=19.9.4, <=26.9.0), at.austriapro:ebinterface-rendering (>=1.0.0, <=1.0.1) +1623 more potentially affected by CVE-2022-42890 via org.apache.xmlgraphics:batik-bridge (>=1.6.1, <=1.15)

org.apache.xmlgraphics:batik-bridge MAVEN version =1.6.1, =19.9.4, =1.0.0, =1.0.7, =1.10.2, =1.13.0, =0.1.1, =0.5.0, =0.11.1, =0.0.2, =0.2.1 - berlin.softwaretechnik:geojsonrenderer2.13 0.0.1 - bio.ferlab:obo-parser2.12 1.3.1 and more Source cves: CVE-2022-42890 Source advisory: GHSA-RWQR-M72Q-V6...

GHSA-53JM-3HC9-FQQC Apache Batik vulnerable to Server-Side Request Forgery

Server-Side Request Forgery SSRF vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources. This issue affects Apache XML Graphics Batik Bridge versions 1.14 and below...

ai.tock:tock-shared (>=19.9.4, <=26.9.0), at.austriapro:ebinterface-rendering (1.0.0) +1621 more potentially affected by CVE-2022-38648 via org.apache.xmlgraphics:batik-bridge (>=1.6.1, <=1.14)

org.apache.xmlgraphics:batik-bridge MAVEN version =1.6.1, =19.9.4, =1.0.7, =1.10.2, =1.13.0, =0.1.1, =0.5.0, =0.11.1, =0.0.2, =0.2.1 - berlin.softwaretechnik:geojsonrenderer2.13 0.0.1 - bio.ferlab:obo-parser2.12 1.3.1 and more Source cves: CVE-2022-38648 Source advisory: GHSA-53JM-3HC9-FQQC...

at.datenwort.openhtmltopdf:openhtmltopdf-latex-support (1.1.3), at.datenwort.openhtmltopdf:openhtmltopdf-mathml-support (1.1.3) +554 more potentially affected by CVE-2022-38398 via org.apache.xmlgraphics:batik-bridge (1.14)

org.apache.xmlgraphics:batik-bridge MAVEN version 1.14 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.xmlgraphics:batik-bridge and may be impacted: - at.datenwort.openhtmltopdf:openhtmltopdf-latex-support 1.1.3 -...

at.datenwort.openhtmltopdf:openhtmltopdf-latex-support (1.1.3), at.datenwort.openhtmltopdf:openhtmltopdf-mathml-support (1.1.3) +554 more potentially affected by CVE-2022-38398 via org.apache.xmlgraphics:batik-bridge (1.14)

org.apache.xmlgraphics:batik-bridge MAVEN version 1.14 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.xmlgraphics:batik-bridge and may be impacted: - at.datenwort.openhtmltopdf:openhtmltopdf-latex-support 1.1.3 -...

at.datenwort.openhtmltopdf:openhtmltopdf-latex-support (1.1.3), at.datenwort.openhtmltopdf:openhtmltopdf-mathml-support (1.1.3) +554 more potentially affected by CVE-2022-38398 via org.apache.xmlgraphics:batik-bridge (1.14)

org.apache.xmlgraphics:batik-bridge MAVEN version 1.14 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.xmlgraphics:batik-bridge and may be impacted: - at.datenwort.openhtmltopdf:openhtmltopdf-latex-support 1.1.3 -...

ai.tock:tock-shared (>=19.9.4, <=26.9.0), at.austriapro:ebinterface-rendering (1.0.0) +1621 more potentially affected by CVE-2022-38648 via org.apache.xmlgraphics:batik-bridge (>=1.6.1, <=1.14)

org.apache.xmlgraphics:batik-bridge MAVEN version =1.6.1, =19.9.4, =1.0.7, =1.10.2, =1.13.0, =0.1.1, =0.5.0, =0.11.1, =0.0.2, =0.2.1 - berlin.softwaretechnik:geojsonrenderer2.13 0.0.1 - bio.ferlab:obo-parser2.12 1.3.1 and more Source cves: CVE-2022-38648 Source advisory: MEND:CVE-2022-38648...