PT-2022-7285 · Apache+10 · Apache Commons Bcel+10

Felix Wilhelm · Published 2022-11-04 · Updated 2025-01-21 · CVE-2022-42920

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Commons BCEL versions prior to 6.6.0

Description The issue is related to an out-of-bounds writing problem in Apache Commons BCEL, which can be exploited to produce arbitrary bytecode. This could be abused in applications that pass attacker-controllable data to the affected APIs, giving the attacker more control over the resulting bytecode than otherwise expected.

Recommendations Update to Apache Commons BCEL 6.6.0 to resolve the issue. As a temporary workaround, consider restricting the use of APIs that allow changing specific class characteristics to minimize the risk of exploitation. Avoid passing attacker-controllable data to these APIs until the issue is resolved.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

ALSA-2023:0005

ALT-PU-2024-16391

ALT-PU-2024-16424

ALT-PU-2024-16692

BDU:2024-02279

CESA-2022_8958

CVE-2022-42920

GHSA-97XG-PHPR-RG8Q

INFSA-2023_0005

OPENSUSE-SU-2022_4306-1

OPENSUSE-SU-2024:12498-1

OPENSUSE-SU-2024:12530-1

RHSA-2022:8958

RHSA-2022:8959

RHSA-2022_8958

RHSA-2023:0004

RHSA-2023:0005

RHSA-2023_0005

RLSA-2023:0005

SUSE-SU-2022:4306-1

SUSE-SU-2022:4331-1

SUSE-SU-2022_4306-1

SUSE-SU-2022_4331-1

USN-7208-1

Affected Products

Alt Linux

Almalinux

Apache Commons Bcel

Astra Linux

Centos

Linuxmint

Red Hat

Red Os

Rocky Linux

Suse

Ubuntu

References · 51

• https://nvd.nist.gov/vuln/detail/CVE-2022-42920 · Security Note
• https://security.gentoo.org/glsa/202401-25 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QMVX6COVXZVS5GPWDODIRW6Z2GE7RPAQ · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-42920 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-42920 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QAMRHAKGIKZNHRBB4VLYTOIOIMMXCUCD · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/QAMRHAKGIKZNHRBB4VLYTOIOIMMXCUCD · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LX3HEB4TV2BVCGDTK5BCLSYOZNQTOBN4 · Vendor Advisory
• https://lists.apache.org/thread/lfxk7q8qmnh5bt9jm6nmjlv5hsxjhrz4 · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2023-0005.html · Vendor Advisory
• https://osv.dev/vulnerability/USN-7208-1 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/703860 · Security Note
• https://linux.oracle.com/errata/ELSA-2022-8958.html · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7208-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/LX3HEB4TV2BVCGDTK5BCLSYOZNQTOBN4 · Vendor Advisory