GitHub Advisoryadvisory · Maven

GHSA-97xg-phpr-rg8q Apache Commons BCEL vulnerable to out-of-bounds write

CRITICAL Published 2022-11-07 Modified 2022-11-08 Official page ↗
Aliases
CVE-2022-42920
Ecosystem
Maven
Packages
org.apache.bcel:bcel
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-787
Reviewed
2022-11-07

Affected packages

• Maven org.apache.bcel:bcel: < 6.6.0 → fixed in 6.6.0

Description

Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds writing issue, these APIs can be used to produce arbitrary bytecode. This could be abused in applications that pass attacker-controllable data to those APIs, giving the attacker more control over the resulting bytecode than otherwise expected. Update to Apache Commons BCEL 6.6.0.

Related

Alias · CVE (1)

  • CVE-2022-42920 Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. vulnerability

Weakness · CWE (1)

  • CWE-787 Out-of-bounds Write weakness

References