CVE-2022-42920
Critical
Description
Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds writing issue, these APIs can be used to produce arbitrary bytecode. This could be abused in applications that pass attacker-controllable data to those APIs, giving the attacker more control over the resulting bytecode than otherwise expected. Update to Apache Commons BCEL 6.6.0.
SeverityCritical
CVSS9.8
Exploit probability—
Product
Apache Commons Bcel
PublishedNov 7, 2022
First seenNov 7, 2022
Weakness typeCWE-787Out-of-bounds write
How to fix
Update
- apache commons_bcel6.6.0 or later
- org.apache.bcel:bcel6.6.0 or later
Vendor advisories
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LX3HEB4TV2BVCGDTK5BCLSYOZNQTOBN4/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QMVX6COVXZVS5GPWDODIRW6Z2GE7RPAQ/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QAMRHAKGIKZNHRBB4VLYTOIOIMMXCUCD/
- security.gentoo.org/glsa/202401-25
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache commons_bcel | v < 6.6.0 | 6.6.0 |
| fedoraproject fedora | 35, 36, 37 | — |
| org.apache.bcel:bcelMaven | v < 6.6.0 | 6.6.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.