Vulnerability in Apache Xalan-Java
CVE-2022-34169
The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 or later. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.
EPSS exploit prediction
EPSS: 0.818 (99.6th percentile), scored .
High probability of exploitation in the next 30 days — patch promptly. 100th percentile — 99.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.810 · newest: 0.818 · change: +0.007
Affected products
- Apache Xalan-Java
- Apache Software Foundation Xalan-J — versions Xalan-J
- Azul Zulu — versions 6.47, 7.54, 8.62
- NetApp 7-Mode Transition Tool
- NetApp Active Iq Unified Manager
- NetApp Cloud Insights Acquisition Unit
- NetApp Cloud Secure Agent
- NetApp Hci Compute Node
- NetApp Hci Management Node
- NetApp Oncommand Insight
Weakness classification (CWE)
Public proof-of-concept exploits
References
- lists.apache.org/thread/2qvl7r43wb4t8p9dd9om1bnkssk07sn8 (Mailing List, Issue Tracking, Vendor Advisory)
- lists.apache.org/thread/12pxy4phsry6c34x2ol4fft6xlho4kyw (Mailing List, Issue Tracking, Vendor Advisory)
- www.openwall.com/lists/oss-security/2022/07/19/5 (mailing-list, Mailing List, Third Party Advisory)
- www.oracle.com/security-alerts/cpujul2022.html (Patch, Third Party Advisory)
- www.openwall.com/lists/oss-security/2022/07/19/6 (mailing-list, Mailing List, Third Party Advisory)
- www.openwall.com/lists/oss-security/2022/07/20/2 (mailing-list, Mailing List, Third Party Advisory)
- www.openwall.com/lists/oss-security/2022/07/20/3 (mailing-list, Patch, Mailing List, Third Party Advisory)
- www.debian.org/security/2022/dsa-5188 (vendor-advisory, Third Party Advisory)
- www.debian.org/security/2022/dsa-5192 (vendor-advisory, Third Party Advisory)
- security.netapp.com/advisory/ntap-20220729-0009/ (Third Party Advisory)
Frequently asked questions
- What is CVE-2022-34169?
- CVE-2022-34169 is a high-severity vulnerability in Apache Xalan-Java, classified under Incorrect Conversion between Numeric Types. CVSS score: 7.5/10. Published 2022-07-19.
- How severe is CVE-2022-34169?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2022-34169 known to be exploited?
- 18 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.