CVE-2022-38398

Опубликовано: 22 сент. 2022

Источник: debian

Описание

Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to load a url thru the jar protocol. This issue affects Apache XML Graphics Batik 1.14.

Пакеты

Пакет	Статус	Версия исправления	Релиз	Тип
batik	fixed	1.15+dfsg-1		package

Примечания

https://www.openwall.com/lists/oss-security/2022/09/22/2
https://issues.apache.org/jira/browse/BATIK-1331
http://svn.apache.org/viewvc?view=revision&revision=1903462
https://www.zerodayinitiative.com/blog/2022/10/28/vulnerabilities-in-apache-batik-default-security-controls-ssrf-and-rce-through-remote-class-loading

Связанные уязвимости

CVE-2022-38398

CVSS3: 5.3

ubuntu

около 4 лет назад

Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to load a url thru the jar protocol. This issue affects Apache XML Graphics Batik 1.14.

CVE-2022-38398

CVSS3: 5.3

redhat

около 4 лет назад

Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to load a url thru the jar protocol. This issue affects Apache XML Graphics Batik 1.14.

CVE-2022-38398

CVSS3: 5.3

nvd

около 4 лет назад

Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to load a url thru the jar protocol. This issue affects Apache XML Graphics Batik 1.14.

GHSA-c5xv-qc8p-mh2v

CVSS3: 5.3

github

около 4 лет назад

Apache Batik Server-Side Request Forgery

ALT-PU-2026-9117

CVSS3: 7.5

altlinux

4 месяца назад

ALT-PU-2026-9117: package `batik` update to version 1.19-alt1