XXE in Apache Calcite
CVE-2022-39135
Apache Calcite 1.22.0 introduced the SQL operators EXISTS_NODE, EXTRACT_XML, XML_TRANSFORM and EXTRACT_VALUE do not restrict XML External Entity references in their configuration, making them vulnerable to a potential XML External Entity (XXE) attack. Therefore any client exposing these operators, typically by using Oracle dialect (the first three) or MySQL dialect (the last one), is affected by this vulnerability (the extent of it will depend on the user under which the application is running). From Apache Calcite 1.32.0 onwards, Document Type Declarations and XML External Entity resolution are disabled on the impacted operators.
Vulnerability class: XXE (XML External Entity)
EPSS: 0.020 (79.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Apache Calcite
- Apache Software Foundation Calcite — versions 1.22.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@apache.org (Mailing List, Vendor Advisory)
- security@apache.org (mailing-list, Mailing List, Third Party Advisory, Mitigation)
Frequently asked questions
- What is CVE-2022-39135?
- CVE-2022-39135 is a critical-severity vulnerability in Apache Calcite, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 9.8/10. Published 2022-09-11.
- How severe is CVE-2022-39135?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2022-39135 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.