PT-2023-7021 · Apache+2 · Apache Xml Graphics Batik+2

Nbxiglk · Publicado 2023-08-22 · Atualizado 2024-03-08 · CVE-2022-44729

Positive Technologies (AI Summary)

CVSS v3.1

7.1

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache XML Graphics Batik version 1.16

Description The issue is related to a Server-Side Request Forgery (SSRF) vulnerability in Apache XML Graphics Batik. This vulnerability can be exploited by a malicious SVG, which could trigger the loading of external resources by default, causing resource consumption or, in some cases, information disclosure.

Recommendations For Apache XML Graphics Batik version 1.16, upgrade to version 1.17 or later to resolve the issue. As a temporary workaround, consider restricting the use of the vulnerable component to minimize the risk of exploitation. Avoid using the vulnerable version of Apache XML Graphics Batik until the issue is resolved.

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

BDU:2023-08042

CVE-2022-44729

DLA-3619-1

GHSA-GQ5F-XV48-2365

OESA-2023-1651

OPENSUSE-SU-2024:13743-1

OPENSUSE-SU-2024_0808-1

SUSE-SU-2024:0777-1

SUSE-SU-2024:0808-1

Produtos afetados

Apache Xml Graphics Batik

Astra Linux

Suse

Referências · 54

• https://github.com/apache/xmlgraphics-batik/commit/85b3457d9902f64d5d409a8da060d5ba47d0b69b · Nota
• https://github.com/apache/xmlgraphics-batik/commit/aaa1dd3e6b5a7df781d73e0c37a1df6a8f318893 · Nota
• https://github.com/apache/xmlgraphics-batik · Nota
• https://suse.com/security/cve/CVE-2022-40146 · Nota
• https://security-tracker.debian.org/tracker/CVE-2022-44729 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-44729 · Aviso do Fabricante
• https://bugzilla.suse.com/1204704 · Nota
• https://security.gentoo.org/glsa/202401-11 · Nota
• https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1651 · Nota
• https://suse.com/security/cve/CVE-2022-44730 · Nota
• https://suse.com/security/cve/CVE-2019-17566 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2022-38648 · Nota de Segurança
• https://ubuntu.com/security/CVE-2022-44729 · Aviso do Fabricante
• https://openwall.com/lists/oss-security/2023/08/22/2 · Nota
• https://osv.dev/vulnerability/DLA-3619-1 · Aviso do Fabricante