CVE-2022-34169
Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets
In short
Apache Xalan's XSLT processor can be tricked by specially crafted stylesheets to generate corrupted Java code, allowing attackers to run arbitrary commands on the system.
Technical detail
An integer truncation vulnerability in Xalan's XSLTC compiler allows attackers to submit malicious XSLT stylesheets that corrupt generated Java bytecode, enabling arbitrary code execution with the privileges of the Java process. The vulnerability requires the application to process untrusted XSLT input.
Summary generated and translated by AI from the official description.
The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 or later. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected products
Apache Software Foundation · Apache Xalan-JWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →References
http://packetstormsecurity.com/files/168186/Xalan-J-XSLTC-Integer-Truncation.htmlhttps://lists.apache.org/thread/12pxy4phsry6c34x2ol4fft6xlho4kywhttps://lists.apache.org/thread/2qvl7r43wb4t8p9dd9om1bnkssk07sn8https://lists.debian.org/debian-lts-announce/2022/10/msg00024.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H4YNJSJ64NPCNKFPNBYITNZU5H3L4D6L/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5OZNAZJ4YHLOKRRRZSWRT5OJ25E4XLM/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN3EVGR7FD3ZLV5SBTJXUIDCMSK4QUE2/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KO3DXNKZ4EU3UZBT6AAR4XRKCD73KLMO/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3XPOTPPBZIPFBZHQE5E7OW6PDACUMCJ/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YULPNO3PAWMEQQZV2C54I3H3ZOXFZUTB/https://security.gentoo.org/glsa/202401-25https://security.netapp.com/advisory/ntap-20220729-0009/