Описание
The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 or later. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Migration Toolkit for Applications 6 | xalan | Will not fix | ||
| Migration Toolkit for Runtimes | xalan | Not affected | ||
| Red Hat AMQ Broker 7 | xalan | Not affected | ||
| Red Hat build of Apache Camel 4 for Quarkus 3 | xalan | Affected | ||
| Red Hat build of Apache Camel for Spring Boot 3 | xalan | Affected | ||
| Red Hat build of Apache Camel for Spring Boot 4 | xalan | Not affected | ||
| Red Hat Build of Keycloak | xalan | Affected | ||
| Red Hat build of OptaPlanner 8 | xalan | Affected | ||
| Red Hat Data Grid 8 | xalan | Not affected | ||
| Red Hat Enterprise Linux 6 | java-1.6.0-openjdk | Out of support scope |
Показывать по
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 or later. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.
The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 or later. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.
Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets
The Apache Xalan Java XSLT library is vulnerable to an integer truncat ...
EPSS
7.5 High
CVSS3