Vulnerability · Published Jul 19, 2022 · Assigned by apache
CVE-2022-34169Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets
High 7.5
In plain English
A high-severity security flaw in Apache Xalan-J from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 81.8% (higher than 99.6% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)81.8%top 0.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC
Official description
The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 or later. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | java-1.8.0-openjdk | 1:1.8.0.342.b07-2.el8_6 | ALSA-2022:5696 |
| AlmaLinux:9 | java-1.8.0-openjdk | 1:1.8.0.342.b07-1.el9_0 | ALSA-2022:5709 |
| AlmaLinux:8 | java-1.8.0-openjdk-accessibility | 1:1.8.0.342.b07-2.el8_6 | ALSA-2022:5696 |
| AlmaLinux:8 | java-1.8.0-openjdk-accessibility-fastdebug | 1:1.8.0.342.b07-2.el8_6 | ALSA-2022:5696 |
| AlmaLinux:8 | java-1.8.0-openjdk-accessibility-slowdebug | 1:1.8.0.342.b07-2.el8_6 | ALSA-2022:5696 |
| AlmaLinux:8 | java-1.8.0-openjdk-demo | 1:1.8.0.342.b07-2.el8_6 | ALSA-2022:5696 |
| AlmaLinux:9 | java-1.8.0-openjdk-demo | 1:1.8.0.342.b07-1.el9_0 | ALSA-2022:5709 |
| AlmaLinux:8 | java-1.8.0-openjdk-demo-fastdebug | 1:1.8.0.342.b07-2.el8_6 | ALSA-2022:5696 |
| AlmaLinux:9 | java-1.8.0-openjdk-demo-fastdebug | 1:1.8.0.342.b07-1.el9_0 | ALSA-2022:5709 |
| AlmaLinux:8 | java-1.8.0-openjdk-demo-slowdebug | 1:1.8.0.342.b07-2.el8_6 | ALSA-2022:5696 |
| AlmaLinux:9 | java-1.8.0-openjdk-demo-slowdebug | 1:1.8.0.342.b07-1.el9_0 | ALSA-2022:5709 |
| AlmaLinux:8 | java-1.8.0-openjdk-devel | 1:1.8.0.342.b07-2.el8_6 | ALSA-2022:5696 |
| AlmaLinux:9 | java-1.8.0-openjdk-devel | 1:1.8.0.342.b07-1.el9_0 | ALSA-2022:5709 |
| AlmaLinux:8 | java-1.8.0-openjdk-devel-fastdebug | 1:1.8.0.342.b07-2.el8_6 | ALSA-2022:5696 |
| AlmaLinux:9 | java-1.8.0-openjdk-devel-fastdebug | 1:1.8.0.342.b07-1.el9_0 | ALSA-2022:5709 |
| AlmaLinux:8 | java-1.8.0-openjdk-devel-slowdebug | 1:1.8.0.342.b07-2.el8_6 | ALSA-2022:5696 |
| AlmaLinux:9 | java-1.8.0-openjdk-devel-slowdebug | 1:1.8.0.342.b07-1.el9_0 | ALSA-2022:5709 |
| AlmaLinux:8 | java-1.8.0-openjdk-fastdebug | 1:1.8.0.342.b07-2.el8_6 | ALSA-2022:5696 |
| AlmaLinux:9 | java-1.8.0-openjdk-fastdebug | 1:1.8.0.342.b07-1.el9_0 | ALSA-2022:5709 |
| AlmaLinux:8 | java-1.8.0-openjdk-headless | 1:1.8.0.342.b07-2.el8_6 | ALSA-2022:5696 |
| AlmaLinux:9 | java-1.8.0-openjdk-headless | 1:1.8.0.342.b07-1.el9_0 | ALSA-2022:5709 |
| AlmaLinux:8 | java-1.8.0-openjdk-headless-fastdebug | 1:1.8.0.342.b07-2.el8_6 | ALSA-2022:5696 |
| AlmaLinux:9 | java-1.8.0-openjdk-headless-fastdebug | 1:1.8.0.342.b07-1.el9_0 | ALSA-2022:5709 |
| AlmaLinux:8 | java-1.8.0-openjdk-headless-slowdebug | 1:1.8.0.342.b07-2.el8_6 | ALSA-2022:5696 |
| AlmaLinux:9 | java-1.8.0-openjdk-headless-slowdebug | 1:1.8.0.342.b07-1.el9_0 | ALSA-2022:5709 |
| AlmaLinux:8 | java-1.8.0-openjdk-javadoc | 1:1.8.0.342.b07-2.el8_6 | ALSA-2022:5696 |
| AlmaLinux:9 | java-1.8.0-openjdk-javadoc | 1:1.8.0.342.b07-1.el9_0 | ALSA-2022:5709 |
| AlmaLinux:8 | java-1.8.0-openjdk-javadoc-zip | 1:1.8.0.342.b07-2.el8_6 | ALSA-2022:5696 |
| AlmaLinux:9 | java-1.8.0-openjdk-javadoc-zip | 1:1.8.0.342.b07-1.el9_0 | ALSA-2022:5709 |
| AlmaLinux:8 | java-1.8.0-openjdk-slowdebug | 1:1.8.0.342.b07-2.el8_6 | ALSA-2022:5696 |
| AlmaLinux:9 | java-1.8.0-openjdk-slowdebug | 1:1.8.0.342.b07-1.el9_0 | ALSA-2022:5709 |
| AlmaLinux:8 | java-1.8.0-openjdk-src | 1:1.8.0.342.b07-2.el8_6 | ALSA-2022:5696 |
| AlmaLinux:9 | java-1.8.0-openjdk-src | 1:1.8.0.342.b07-1.el9_0 | ALSA-2022:5709 |
| AlmaLinux:8 | java-1.8.0-openjdk-src-fastdebug | 1:1.8.0.342.b07-2.el8_6 | ALSA-2022:5696 |
| AlmaLinux:9 | java-1.8.0-openjdk-src-fastdebug | 1:1.8.0.342.b07-1.el9_0 | ALSA-2022:5709 |
| AlmaLinux:8 | java-1.8.0-openjdk-src-slowdebug | 1:1.8.0.342.b07-2.el8_6 | ALSA-2022:5696 |
| AlmaLinux:9 | java-1.8.0-openjdk-src-slowdebug | 1:1.8.0.342.b07-1.el9_0 | ALSA-2022:5709 |
| AlmaLinux:8 | java-11-openjdk | 1:11.0.16.0.8-1.el8_6 | ALSA-2022:5683 |
| AlmaLinux:9 | java-11-openjdk | 1:11.0.16.0.8-1.el9_0 | ALSA-2022:5695 |
| AlmaLinux:8 | java-11-openjdk-demo | 1:11.0.16.0.8-1.el8_6 | ALSA-2022:5683 |
| AlmaLinux:9 | java-11-openjdk-demo | 1:11.0.16.0.8-1.el9_0 | ALSA-2022:5695 |
| AlmaLinux:8 | java-11-openjdk-demo-fastdebug | 1:11.0.16.0.8-1.el8_6 | ALSA-2022:5683 |
| AlmaLinux:9 | java-11-openjdk-demo-fastdebug | 1:11.0.16.0.8-1.el9_0 | ALSA-2022:5695 |
| AlmaLinux:8 | java-11-openjdk-demo-slowdebug | 1:11.0.16.0.8-1.el8_6 | ALSA-2022:5683 |
| AlmaLinux:9 | java-11-openjdk-demo-slowdebug | 1:11.0.16.0.8-1.el9_0 | ALSA-2022:5695 |
| AlmaLinux:8 | java-11-openjdk-devel | 1:11.0.16.0.8-1.el8_6 | ALSA-2022:5683 |
| AlmaLinux:9 | java-11-openjdk-devel | 1:11.0.16.0.8-1.el9_0 | ALSA-2022:5695 |
| AlmaLinux:8 | java-11-openjdk-devel-fastdebug | 1:11.0.16.0.8-1.el8_6 | ALSA-2022:5683 |
| AlmaLinux:9 | java-11-openjdk-devel-fastdebug | 1:11.0.16.0.8-1.el9_0 | ALSA-2022:5695 |
| AlmaLinux:8 | java-11-openjdk-devel-slowdebug | 1:11.0.16.0.8-1.el8_6 | ALSA-2022:5683 |
| AlmaLinux:9 | java-11-openjdk-devel-slowdebug | 1:11.0.16.0.8-1.el9_0 | ALSA-2022:5695 |
| AlmaLinux:8 | java-11-openjdk-fastdebug | 1:11.0.16.0.8-1.el8_6 | ALSA-2022:5683 |
| AlmaLinux:9 | java-11-openjdk-fastdebug | 1:11.0.16.0.8-1.el9_0 | ALSA-2022:5695 |
| AlmaLinux:8 | java-11-openjdk-headless | 1:11.0.16.0.8-1.el8_6 | ALSA-2022:5683 |
| AlmaLinux:9 | java-11-openjdk-headless | 1:11.0.16.0.8-1.el9_0 | ALSA-2022:5695 |
| AlmaLinux:8 | java-11-openjdk-headless-fastdebug | 1:11.0.16.0.8-1.el8_6 | ALSA-2022:5683 |
| AlmaLinux:9 | java-11-openjdk-headless-fastdebug | 1:11.0.16.0.8-1.el9_0 | ALSA-2022:5695 |
| AlmaLinux:8 | java-11-openjdk-headless-slowdebug | 1:11.0.16.0.8-1.el8_6 | ALSA-2022:5683 |
| AlmaLinux:9 | java-11-openjdk-headless-slowdebug | 1:11.0.16.0.8-1.el9_0 | ALSA-2022:5695 |
| AlmaLinux:8 | java-11-openjdk-javadoc | 1:11.0.16.0.8-1.el8_6 | ALSA-2022:5683 |
| AlmaLinux:9 | java-11-openjdk-javadoc | 1:11.0.16.0.8-1.el9_0 | ALSA-2022:5695 |
| AlmaLinux:8 | java-11-openjdk-javadoc-zip | 1:11.0.16.0.8-1.el8_6 | ALSA-2022:5683 |
| AlmaLinux:9 | java-11-openjdk-javadoc-zip | 1:11.0.16.0.8-1.el9_0 | ALSA-2022:5695 |
| AlmaLinux:8 | java-11-openjdk-jmods | 1:11.0.16.0.8-1.el8_6 | ALSA-2022:5683 |
| AlmaLinux:9 | java-11-openjdk-jmods | 1:11.0.16.0.8-1.el9_0 | ALSA-2022:5695 |
| AlmaLinux:8 | java-11-openjdk-jmods-fastdebug | 1:11.0.16.0.8-1.el8_6 | ALSA-2022:5683 |
| AlmaLinux:9 | java-11-openjdk-jmods-fastdebug | 1:11.0.16.0.8-1.el9_0 | ALSA-2022:5695 |
| AlmaLinux:8 | java-11-openjdk-jmods-slowdebug | 1:11.0.16.0.8-1.el8_6 | ALSA-2022:5683 |
| AlmaLinux:9 | java-11-openjdk-jmods-slowdebug | 1:11.0.16.0.8-1.el9_0 | ALSA-2022:5695 |
| AlmaLinux:8 | java-11-openjdk-slowdebug | 1:11.0.16.0.8-1.el8_6 | ALSA-2022:5683 |
| AlmaLinux:9 | java-11-openjdk-slowdebug | 1:11.0.16.0.8-1.el9_0 | ALSA-2022:5695 |
| AlmaLinux:8 | java-11-openjdk-src | 1:11.0.16.0.8-1.el8_6 | ALSA-2022:5683 |
| AlmaLinux:9 | java-11-openjdk-src | 1:11.0.16.0.8-1.el9_0 | ALSA-2022:5695 |
| AlmaLinux:8 | java-11-openjdk-src-fastdebug | 1:11.0.16.0.8-1.el8_6 | ALSA-2022:5683 |
| AlmaLinux:9 | java-11-openjdk-src-fastdebug | 1:11.0.16.0.8-1.el9_0 | ALSA-2022:5695 |
| AlmaLinux:8 | java-11-openjdk-src-slowdebug | 1:11.0.16.0.8-1.el8_6 | ALSA-2022:5683 |
| AlmaLinux:9 | java-11-openjdk-src-slowdebug | 1:11.0.16.0.8-1.el9_0 | ALSA-2022:5695 |
| AlmaLinux:8 | java-11-openjdk-static-libs | 1:11.0.16.0.8-1.el8_6 | ALSA-2022:5683 |
| AlmaLinux:9 | java-11-openjdk-static-libs | 1:11.0.16.0.8-1.el9_0 | ALSA-2022:5695 |
| AlmaLinux:8 | java-11-openjdk-static-libs-fastdebug | 1:11.0.16.0.8-1.el8_6 | ALSA-2022:5683 |
| AlmaLinux:9 | java-11-openjdk-static-libs-fastdebug | 1:11.0.16.0.8-1.el9_0 | ALSA-2022:5695 |
| AlmaLinux:8 | java-11-openjdk-static-libs-slowdebug | 1:11.0.16.0.8-1.el8_6 | ALSA-2022:5683 |
| AlmaLinux:9 | java-11-openjdk-static-libs-slowdebug | 1:11.0.16.0.8-1.el9_0 | ALSA-2022:5695 |
| AlmaLinux:9 | java-17-openjdk | 1:17.0.4.0.8-2.el9_0 | ALSA-2022:5736 |
| AlmaLinux:9 | java-17-openjdk-demo | 1:17.0.4.0.8-2.el9_0 | ALSA-2022:5736 |
| AlmaLinux:9 | java-17-openjdk-demo-fastdebug | 1:17.0.4.0.8-2.el9_0 | ALSA-2022:5736 |
| AlmaLinux:9 | java-17-openjdk-demo-slowdebug | 1:17.0.4.0.8-2.el9_0 | ALSA-2022:5736 |
| AlmaLinux:9 | java-17-openjdk-devel | 1:17.0.4.0.8-2.el9_0 | ALSA-2022:5736 |
| AlmaLinux:9 | java-17-openjdk-devel-fastdebug | 1:17.0.4.0.8-2.el9_0 | ALSA-2022:5736 |
| AlmaLinux:9 | java-17-openjdk-devel-slowdebug | 1:17.0.4.0.8-2.el9_0 | ALSA-2022:5736 |
| AlmaLinux:9 | java-17-openjdk-fastdebug | 1:17.0.4.0.8-2.el9_0 | ALSA-2022:5736 |
| AlmaLinux:9 | java-17-openjdk-headless | 1:17.0.4.0.8-2.el9_0 | ALSA-2022:5736 |
| AlmaLinux:9 | java-17-openjdk-headless-fastdebug | 1:17.0.4.0.8-2.el9_0 | ALSA-2022:5736 |
| AlmaLinux:9 | java-17-openjdk-headless-slowdebug | 1:17.0.4.0.8-2.el9_0 | ALSA-2022:5736 |
| AlmaLinux:9 | java-17-openjdk-javadoc | 1:17.0.4.0.8-2.el9_0 | ALSA-2022:5736 |
| AlmaLinux:9 | java-17-openjdk-javadoc-zip | 1:17.0.4.0.8-2.el9_0 | ALSA-2022:5736 |
| AlmaLinux:9 | java-17-openjdk-jmods | 1:17.0.4.0.8-2.el9_0 | ALSA-2022:5736 |
| AlmaLinux:9 | java-17-openjdk-jmods-fastdebug | 1:17.0.4.0.8-2.el9_0 | ALSA-2022:5736 |
| AlmaLinux:9 | java-17-openjdk-jmods-slowdebug | 1:17.0.4.0.8-2.el9_0 | ALSA-2022:5736 |
| AlmaLinux:9 | java-17-openjdk-slowdebug | 1:17.0.4.0.8-2.el9_0 | ALSA-2022:5736 |
| AlmaLinux:9 | java-17-openjdk-src | 1:17.0.4.0.8-2.el9_0 | ALSA-2022:5736 |
| AlmaLinux:9 | java-17-openjdk-src-fastdebug | 1:17.0.4.0.8-2.el9_0 | ALSA-2022:5736 |
| AlmaLinux:9 | java-17-openjdk-src-slowdebug | 1:17.0.4.0.8-2.el9_0 | ALSA-2022:5736 |
| AlmaLinux:9 | java-17-openjdk-static-libs | 1:17.0.4.0.8-2.el9_0 | ALSA-2022:5736 |
| AlmaLinux:9 | java-17-openjdk-static-libs-fastdebug | 1:17.0.4.0.8-2.el9_0 | ALSA-2022:5736 |
| AlmaLinux:9 | java-17-openjdk-static-libs-slowdebug | 1:17.0.4.0.8-2.el9_0 | ALSA-2022:5736 |
| Alpine:v3.20 | openjdk11 | 11.0.16_p8-r0 | ALPINE-CVE-2022-34169 |
| Alpine:v3.21 | openjdk11 | 11.0.16_p8-r0 | ALPINE-CVE-2022-34169 |
| Alpine:v3.22 | openjdk11 | 11.0.16_p8-r0 | ALPINE-CVE-2022-34169 |
| Alpine:v3.23 | openjdk11 | 11.0.16_p8-r0 | ALPINE-CVE-2022-34169 |
| Alpine:v3.24 | openjdk11 | 11.0.16_p8-r0 | ALPINE-CVE-2022-34169 |
| Alpine:v3.20 | openjdk17 | 17.0.4_p8-r0 | ALPINE-CVE-2022-34169 |
| Alpine:v3.21 | openjdk17 | 17.0.4_p8-r0 | ALPINE-CVE-2022-34169 |
| Alpine:v3.22 | openjdk17 | 17.0.4_p8-r0 | ALPINE-CVE-2022-34169 |
| Alpine:v3.23 | openjdk17 | 17.0.4_p8-r0 | ALPINE-CVE-2022-34169 |
| Alpine:v3.24 | openjdk17 | 17.0.4_p8-r0 | ALPINE-CVE-2022-34169 |
| Alpine:v3.20 | openjdk8 | 8.345.01-r0 | ALPINE-CVE-2022-34169 |
| Alpine:v3.21 | openjdk8 | 8.345.01-r0 | ALPINE-CVE-2022-34169 |
| Alpine:v3.22 | openjdk8 | 8.345.01-r0 | ALPINE-CVE-2022-34169 |
| Alpine:v3.23 | openjdk8 | 8.345.01-r0 | ALPINE-CVE-2022-34169 |
| Alpine:v3.24 | openjdk8 | 8.345.01-r0 | ALPINE-CVE-2022-34169 |
| Debian:12 | bcel | 6.5.0-2 | DEBIAN-CVE-2022-34169 |
| Debian:13 | bcel | 6.5.0-2 | DEBIAN-CVE-2022-34169 |
| Debian:14 | bcel | 6.5.0-2 | DEBIAN-CVE-2022-34169 |
| Debian:12 | openjdk-17 | 17.0.4+8-1 | DEBIAN-CVE-2022-34169 |
| Maven | xalan:xalan | 2.7.3 | GHSA-9339-86wc-4qgf |
| Rocky Linux:8 | java-1.8.0-openjdk | 1:1.8.0.342.b07-2.el8_6 | RLSA-2022:5696 |
| Rocky Linux:8 | java-11-openjdk | 1:11.0.16.0.8-1.el8_6 | RLSA-2022:5683 |
| Rocky Linux:8 | java-17-openjdk | 1:17.0.4.0.8-2.el8_6 | RLSA-2022:5726 |
| Ubuntu:22.04:LTS | libxalan2-java | no fix listed | UBUNTU-CVE-2022-34169 |
| Ubuntu:24.04:LTS | libxalan2-java | no fix listed | UBUNTU-CVE-2022-34169 |
| Ubuntu:25.10 | libxalan2-java | no fix listed | UBUNTU-CVE-2022-34169 |
| Ubuntu:26.04:LTS | libxalan2-java | no fix listed | UBUNTU-CVE-2022-34169 |
| Ubuntu:26.10 | libxalan2-java | no fix listed | UBUNTU-CVE-2022-34169 |
| Ubuntu:22.04:LTS | openjdk-17 | 17.0.4+8-1~22.04 | USN-5546-1 |
| Ubuntu:22.04:LTS | openjdk-17 | 17.0.4+8-1~22.04 | UBUNTU-CVE-2022-34169 |
| Ubuntu:22.04:LTS | openjdk-18 | 18.0.2+9-2~22.04 | USN-5546-1 |
| Ubuntu:22.04:LTS | openjdk-18 | 18.0.2+9-2~22.04 | UBUNTU-CVE-2022-34169 |
| Ubuntu:22.04:LTS | openjdk-8 | 8u342-b07-0ubuntu1~22.04 | UBUNTU-CVE-2022-34169 |
| Ubuntu:22.04:LTS | openjdk-8 | 8u342-b07-0ubuntu1~22.04 | USN-5546-1 |
| Ubuntu:22.04:LTS | openjdk-lts | 11.0.16+8-0ubuntu1~22.04 | USN-5546-1 |
| Ubuntu:22.04:LTS | openjdk-lts | 11.0.16+8-0ubuntu1~22.04 | UBUNTU-CVE-2022-34169 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Xalan-J | Xalan-J – through 2.7.2 |
Weakness: CWE-681 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
References
- https://lists.apache.org/thread/2qvl7r43wb4t8p9dd9om1bnkssk07sn8
- https://lists.apache.org/thread/12pxy4phsry6c34x2ol4fft6xlho4kyw
- [oss-security] 20220719 CVE-2022-34169: Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets mailing-list
- https://www.oracle.com/security-alerts/cpujul2022.html
- [oss-security] 20220719 Re: CVE-2022-34169: Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets mailing-list
- [oss-security] 20220719 Re: CVE-2022-34169: Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets mailing-list
- [oss-security] 20220720 Re: CVE-2022-34169: Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets mailing-list
- DSA-5188 vendor-advisory
- DSA-5192 vendor-advisory
- https://security.netapp.com/advisory/ntap-20220729-0009/
- FEDORA-2022-19b6f21746 vendor-advisory
- FEDORA-2022-ae563934f7 vendor-advisory
- FEDORA-2022-e573851f56 vendor-advisory
- FEDORA-2022-d26586b419 vendor-advisory
- FEDORA-2022-80afe2304a vendor-advisory
- FEDORA-2022-b76ab52e73 vendor-advisory
- http://packetstormsecurity.com/files/168186/Xalan-J-XSLTC-Integer-Truncation.html
- [oss-security] 20221017 Re: CVE-2022-34169: Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets mailing-list
- [debian-lts-announce] 20221018 [SECURITY] [DLA 3155-1] bcel security update mailing-list
- DSA-5256 vendor-advisory
- [oss-security] 20221104 Re: CVE-2022-42920: Apache Commons BCEL prior to 6.6.0 allows producing arbitrary bytecode via out-of-bounds writing mailing-list
- [oss-security] 20221107 Re: CVE-2022-42920: Apache Commons BCEL prior to 6.6.0 allows producing arbitrary bytecode via out-of-bounds writing mailing-list
- https://security.gentoo.org/glsa/202401-25
- https://security.netapp.com/advisory/ntap-20240621-0006/