CVEvulnerability

CVE-2022-34169

7.5 HIGH Published 2022-07-19 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-07-19
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-681

Description

The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 or later. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.

Affected configurations

• apache xalan-java (<= 2.7.2) • debian debian linux 10.0 • debian debian linux 11.0 • oracle graalvm 20.3.6 • oracle graalvm 21.3.2 • oracle graalvm 22.1.0 • oracle jdk 1.7.0 • oracle jdk 1.8.0 • oracle jdk 11.0.15.1 • oracle jdk 17.0.3.1 • oracle jdk 18.0.1.1 • oracle jre 1.7.0 • oracle jre 1.8.0 • oracle jre 11.0.15.1 • oracle jre 17.0.3.1 • oracle jre 18.0.1.1 • oracle openjdk (>= 11 <= 11.0.15) • oracle openjdk (>= 13 <= 13.0.11) • oracle openjdk (>= 15 <= 15.0.7) • oracle openjdk (>= 17 <= 17.0.3) • oracle openjdk 7 • oracle openjdk 8 • oracle openjdk 18 • fedoraproject fedora 35 • fedoraproject fedora 36 • netapp 7-mode transition tool • netapp active iq unified manager • netapp cloud insights acquisition unit • netapp cloud secure agent • netapp hci management node • netapp oncommand insight • netapp solidfire • netapp hci compute node • azul zulu 6.47 • azul zulu 7.54 • azul zulu 8.62 • azul zulu 11.56 • azul zulu 13.48 • azul zulu 15.40 • azul zulu 17.34 • azul zulu 18.30

Related

Weakness · CWE (1)

  • CWE-681 Incorrect Conversion between Numeric Types weakness

References