Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets
43Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.5epss 81%
exploitation probability
81%top 1% of all CVEs
observed exploitation
nono source reports it
What the vendors declare (VEX)
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Red HatVEX document ↗
Affected
11 products (48 components)
Red Hat Enterprise Linux 6 · Red Hat Enterprise Linux 7 · Migration Toolkit for Applications 6 · Red Hat Build of Keycloak · Red Hat Fuse 7 · and others 6
no_fix_planned: Will not fix
Fixed
28 products (1,862 components)
Red Hat Enterprise Linux CRB (v. 8) · Red Hat CodeReady Linux Builder (v. 9) · Red Hat Enterprise Linux AppStream (v. 8) · Red Hat Enterprise Linux AppStream (v. 9) · Red Hat Enterprise Linux AppStream EUS (v.8.4) · and others 23
Not affected
9 products (27 components) — because the vulnerable code is not present in the product
Red Hat Enterprise Linux 7 · Red Hat Enterprise Linux 8 · Migration Toolkit for Runtimes · Red Hat AMQ Broker 7 · Red Hat Data Grid 8 · and others 4
In short
Apache Xalan's XSLT processor can be tricked by specially crafted stylesheets to generate corrupted Java code, allowing attackers to run arbitrary commands on the system.
Technical detail
An integer truncation vulnerability in Xalan's XSLTC compiler allows attackers to submit malicious XSLT stylesheets that corrupt generated Java bytecode, enabling arbitrary code execution with the privileges of the Java process. The vulnerability requires the application to process untrusted XSLT input.
Summary generated and translated by AI from the official description.
The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 or later. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected products
Apache Software Foundation · Apache Xalan-JReferences
http://packetstormsecurity.com/files/168186/Xalan-J-XSLTC-Integer-Truncation.htmlhttps://lists.apache.org/thread/12pxy4phsry6c34x2ol4fft6xlho4kywhttps://lists.apache.org/thread/2qvl7r43wb4t8p9dd9om1bnkssk07sn8https://lists.debian.org/debian-lts-announce/2022/10/msg00024.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H4YNJSJ64NPCNKFPNBYITNZU5H3L4D6L/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5OZNAZJ4YHLOKRRRZSWRT5OJ25E4XLM/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN3EVGR7FD3ZLV5SBTJXUIDCMSK4QUE2/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KO3DXNKZ4EU3UZBT6AAR4XRKCD73KLMO/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3XPOTPPBZIPFBZHQE5E7OW6PDACUMCJ/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YULPNO3PAWMEQQZV2C54I3H3ZOXFZUTB/https://security.gentoo.org/glsa/202401-25https://security.netapp.com/advisory/ntap-20220729-0009/