Integer Truncation Vulnerability in Apache Xalan Java XSLT Library Affecting BCEL and OpenJDK Packages
Summary
DEBIAN-CVE-2022-34169: The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. Affects bcel versions < 6.5.0-1+deb11u1. Fixed in 6.5.0-1+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Apache Xalan Java XSLT library is a powerful tool used for transforming XML documents into various formats using XSLT stylesheets. It is widely integrated into Java runtimes, including OpenJDK, which repackages Xalan for its users. The library's functionality is critical for applications that rely on XML processing, making it essential for developers. However, a recently discovered integer truncation vulnerability poses significant risks, allowing attackers to exploit the library's processing of malicious XSLT stylesheets.
Vulnerability Detail
The vulnerability arises from an integer truncation issue within the Apache Xalan library when it processes specially crafted XSLT stylesheets. This flaw can lead to the corruption of Java class files generated by the internal XSLTC compiler, potentially enabling the execution of arbitrary Java bytecode. If exploited, this vulnerability could allow attackers to execute malicious code within the context of the affected application, leading to severe security breaches.
How To Fix
Minimum fixed version
6.5.0-1+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade bcelTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid processing untrusted or malicious XSLT stylesheets until the package is updated. This can help mitigate the risk of exploitation while waiting for a patch.
Conclusion
The integer truncation vulnerability in the Apache Xalan Java XSLT library poses significant risks to applications using the affected BCEL and OpenJDK packages. Users are strongly advised to update to the patched versions to safeguard their systems against potential exploitation.
See every vulnerability recorded for bcel →
FAQ
The Apache Xalan library is a Java-based tool for transforming XML documents using XSLT stylesheets, widely used in Java applications.
The vulnerability allows attackers to exploit the processing of malicious XSLT stylesheets, leading to the corruption of Java class files and potential execution of arbitrary code.
The affected packages include BCEL and OpenJDK versions 11 and 17 across various Debian releases.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
If immediate updates are not possible, avoid processing untrusted XSLT stylesheets to mitigate the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for bcel.
