Security Update for batik
Summary
DLA-3619-1: batik - security update. Affects batik versions < 1.10-2+deb10u3. Fixed in 1.10-2+deb10u3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Batik is a toolkit for applications or applets that use images in the Scalable Vector Graphics (SVG) format. It enables various functionalities such as viewing, generation, and manipulation of SVG images. However, several security vulnerabilities have been identified in the batik package.
Vulnerability Detail
The vulnerabilities in batik include:
-
CVE-2020-11987: A server-side request forgery vulnerability that allows an attacker to exploit improper input validation by the NodePickerPanel, leading to arbitrary GET requests.
-
CVE-2022-38398: A server-side request forgery vulnerability that enables an attacker to load a URL through the jar protocol.
-
CVE-2022-38648: A server-side request forgery vulnerability that allows an attacker to fetch external resources.
-
CVE-2022-40146: A server-side request forgery vulnerability that enables an attacker to access files using a Jar URL.
-
CVE-2022-44729: A server-side request forgery vulnerability that allows a malicious SVG to trigger the loading of external resources, potentially causing resource consumption or information disclosure.
-
CVE-2022-44730: A server-side request forgery vulnerability that allows a malicious SVG to probe user profile/data and send it as a parameter to a URL.
How To Fix
Minimum fixed version
1.10-2+deb10u3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade batikTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Upgrading your batik packages to the latest version is crucial to address these security vulnerabilities. If you need further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for batik →
FAQ
Batik is a toolkit for working with Scalable Vector Graphics (SVG) images.
A server-side request forgery vulnerability allows an attacker to manipulate the server into making unintended requests to other resources.
By crafting specially-crafted arguments or malicious SVG files, an attacker can trigger the vulnerabilities and perform unauthorized actions on the server.
The vulnerabilities can lead to arbitrary GET requests, loading of external resources, unauthorized access to files, resource consumption, and information disclosure.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by these vulnerabilities. Simply upload your manifest file (e.g., package-lock.json) and Vulert will provide real-time alerts for open-source vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for batik.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.