CVE-2022-34169
Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets
Em resumo
A biblioteca Apache Xalan pode ser enganada por folhas de estilos XSLT especialmente criadas para gerar código Java corrompido, permitindo que atacantes executem comandos arbitrários no sistema.
Detalhe técnico
Uma vulnerabilidade de truncamento de inteiro no compilador XSLTC do Xalan permite que atacantes enviem folhas de estilos XSLT maliciosas que corrompem o bytecode Java gerado, possibilitando execução arbitrária de código com os privilégios do processo Java. A vulnerabilidade requer que a aplicação processe entrada XSLT não confiável.
Resumo gerado e traduzido por IA a partir da descrição oficial.
The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 or later. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Produtos afetados
Apache Software Foundation · Apache Xalan-JQuer saber se a sua infraestrutura está exposta a isto?
Falar com a TrueHacking →Referências
http://packetstormsecurity.com/files/168186/Xalan-J-XSLTC-Integer-Truncation.htmlhttps://lists.apache.org/thread/12pxy4phsry6c34x2ol4fft6xlho4kywhttps://lists.apache.org/thread/2qvl7r43wb4t8p9dd9om1bnkssk07sn8https://lists.debian.org/debian-lts-announce/2022/10/msg00024.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H4YNJSJ64NPCNKFPNBYITNZU5H3L4D6L/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5OZNAZJ4YHLOKRRRZSWRT5OJ25E4XLM/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN3EVGR7FD3ZLV5SBTJXUIDCMSK4QUE2/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KO3DXNKZ4EU3UZBT6AAR4XRKCD73KLMO/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3XPOTPPBZIPFBZHQE5E7OW6PDACUMCJ/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YULPNO3PAWMEQQZV2C54I3H3ZOXFZUTB/https://security.gentoo.org/glsa/202401-25https://security.netapp.com/advisory/ntap-20220729-0009/