CVE-2022-34169: Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets
An integer truncation issue was found in the Xalan Java XSLT library when processing malicious stylesheets. This flaw could be used to potentially execute arbitrary Java bytecode.
Other sources
The Apache Xalan Java XSLT library could allow a remote attacker to execute arbitrary code on the system, caused by an integer truncation issue when processing malicious XSLT stylesheets. By using specially crafted XSLT stylesheets, an attacker could exploit this vulnerability to execute arbitrary code on the system.
— IBM
The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode.
A fix for this issue was published in September 2022 as part of an anticipated 2.7.3 release.
— GitHub
The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 or later. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2022-34169?
CVE-2022-34169 is a vulnerability in the Apache Xalan Java XSLT library that allows a remote attacker to execute arbitrary code on the system.
How does CVE-2022-34169 impact the Apache Xalan Java XSLT library?
CVE-2022-34169 can be exploited by processing malicious XSLT stylesheets, leading to the corruption of Java class files and the execution of arbitrary Java bytecode.
What is the severity of CVE-2022-34169?
CVE-2022-34169 has a severity rating of 7.5 (high).
What software versions are affected by CVE-2022-34169?
The following software versions are affected by CVE-2022-34169: Apache Xalan Java XSLT library versions up to 2.7.2, OpenJDK 11 versions up to 11.0.17, OpenJDK 17 versions up to 17.0.5, and IBM Security Verify Governance versions up to 10.0.
How can I mitigate CVE-2022-34169?
To mitigate CVE-2022-34169, users are recommended to update to Apache Xalan Java XSLT library version 2.7.3 or later. Additionally, update OpenJDK 11 to versions 11.0.18 or later, OpenJDK 17 to versions 17.0.6 or later, and IBM Security Verify Governance to version 10.0.1 or later.