oss-security - [CVE-2022-42890] Apache Batik information disclosure vulnerability

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Date: Tue, 25 Oct 2022 11:30:07 +0100
From: "Simon Steiner" <simonsteiner1984@...il.com>
To: <general@...graphics.apache.org>,
	<batik-dev@...graphics.apache.org>,
	<batik-users@...graphics.apache.org>,
	"'Apache Security Team'" <security@...che.org>,
	<oss-security@...ts.openwall.com>
Subject: [CVE-2022-42890] Apache Batik information disclosure vulnerability

CVE-2022-42890:
        Apache Batik information disclosure vulnerability

Severity:
        Medium

Vendor:
        The Apache Software Foundation

Versions Affected:
        Batik 1.0 - 1.15

Description:
        Restrict what java classes can be run thru JavaScript

Mitigation:
        Users should upgrade to Batik 1.16+

Credit:
        This issue was independently reported by Y4tacker and 4ra1n of
Chaitin Tech

References:
        http://xmlgraphics.apache.org/security.html
        https://issues.apache.org/jira/browse/BATIK-1345

The Apache XML Graphics team.

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.