Date: Mon, 17 Oct 2022 23:57:45 +0200 From: Markus Koschany <apo@...ian.org> To: oss-security@...ts.openwall.com Subject: Re: CVE-2022-34169: Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets Hi, it appears the underlying bug is in Apache Commons bcel and not in Apache Xalan itself. See https://bugs.debian.org/1015860 and https://github.com/apache/commons-bcel/pull/147 https://github.com/apache/commons-bcel/commit/f3267cbcc900f80851d561bdd16b239d936947f5 Download attachment "signature.asc" of type "application/pgp-signature" (964 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.