CVE-2022-34169
High
Description
The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 or later. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Oracle Openjdk
PublishedJul 19, 2022
First seenJul 19, 2022
Weakness typeCWE-681CWE-681
How to fix
Update
- xalan:xalan2.7.3 or later
Vendor advisories
- debian.org/security/2022/dsa-5188
- debian.org/security/2022/dsa-5192
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KO3DXNKZ4EU3UZBT6AAR4XRKCD73KLMO/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN3EVGR7FD3ZLV5SBTJXUIDCMSK4QUE2/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YULPNO3PAWMEQQZV2C54I3H3ZOXFZUTB/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5OZNAZJ4YHLOKRRRZSWRT5OJ25E4XLM/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3XPOTPPBZIPFBZHQE5E7OW6PDACUMCJ/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H4YNJSJ64NPCNKFPNBYITNZU5H3L4D6L/
- debian.org/security/2022/dsa-5256
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| oracle openjdk | 11 ≤ v ≤ 11.0.15, 13 ≤ v ≤ 13.0.11, 15 ≤ v ≤ 15.0.7, 17 ≤ v ≤ 17.0.3, 7, 8, 18 | — |
| apache xalan-java | v ≤ 2.7.2 | — |
| debian debian_linux | 10.0, 11.0 | — |
| oracle graalvm | 20.3.6, 21.3.2, 22.1.0 | — |
| oracle jdk | 1.7.0, 1.8.0, 11.0.15.1, 17.0.3.1, 18.0.1.1 | — |
| oracle jre | 1.7.0, 1.8.0, 11.0.15.1, 17.0.3.1, 18.0.1.1 | — |
| fedoraproject fedora | 35, 36 | — |
| netapp 7-mode_transition_tool | No range specified | — |
| netapp active_iq_unified_manager | No range specified | — |
| netapp cloud_insights_acquisition_unit | No range specified | — |
| netapp cloud_secure_agent | No range specified | — |
| netapp hci_management_node | No range specified | — |
| netapp oncommand_insight | No range specified | — |
| netapp solidfire | No range specified | — |
| netapp hci_compute_node | No range specified | — |
| azul zulu | 6.47, 7.54, 8.62, 11.56, 13.48, 15.40, 17.34, 18.30 | — |
| xalan:xalanMaven | v < 2.7.3 | 2.7.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.