CVE-2022-34169 in the critical feed json
Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets
published 2022-07-19 4 y ago modified 2026-09-08 2 mo ago also BIT-java-2022-34169 , BIT-java-min-2022-34169 , BIT-jre-2022-34169 , EUVD-2022-6300 , GHSA-9339-86wc-4qgf
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 81.8%
- EPSS 81.8% chance of exploitation in 30 days, percentile 99.6%
- public exploits
- 0
- none known
Summary
The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 or later. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.
Patch / fix
- maven xalan:xalan 2.7.3
- bcel Debian 14, Debian 13, Debian 12 6.5.0-2
- openjdk-17 Debian 12 17.0.4+8-1
debian advisories DEBIAN-CVE-2022-34169
- openjdk-8 Ubuntu 18.04 LTS 8u342-b07-0ubuntu1~18.04
- openjdk-8 Ubuntu 20.04 LTS 8u342-b07-0ubuntu1~20.04
- openjdk-8 Ubuntu 22.04 LTS 8u342-b07-0ubuntu1~22.04
- openjdk-17 Ubuntu 18.04 LTS 17.0.4+8-1~18.04
- openjdk-17 Ubuntu 20.04 LTS 17.0.4+8-1~20.04
- openjdk-17 Ubuntu 22.04 LTS 17.0.4+8-1~22.04
- openjdk-18 Ubuntu 22.04 LTS 18.0.2+9-2~22.04
- openjdk-lts Ubuntu 18.04 LTS 11.0.16+8-0ubuntu1~18.04
ubuntu advisories UBUNTU-CVE-2022-34169
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- eap8-hppc jboss enterprise application platform 8.0 0.8.1-2.redhat_00001.1.el8eap
- eap8-log4j jboss enterprise application platform 8.0 2.22.1-1.redhat_00002.1.el8eap
- eap8-slf4j jboss enterprise application platform 8.0 2.0.16-1.redhat_00001.1.el8eap
- eap8-jctools jboss enterprise application platform 8.0 4.0.2-1.redhat_00001.1.el8eap
- eap8-jgroups jboss enterprise application platform 8.0 5.3.10-1.Final_redhat_00001.1.el8eap
- eap8-wildfly jboss enterprise application platform 8.0 8.0.4-2.GA_redhat_00005.1.el8eap
- eap8-narayana jboss enterprise application platform 8.0 6.0.3-1.Final_redhat_00001.1.el8eap
- eap8-asyncutil jboss enterprise application platform 8.0 0.1.0-2.redhat_00010.1.el8eap
red hat advisories RHSA-2024:8823RHSA-2024:10208RHSA-2024:10207RHSA-2024:8824RHSA-2024:8077RHSA-2024:8075
- mojo-parent openSUSE Leap 15.6, openSUSE Leap 15.5 82-150200.3.10.1
- bcel SLES for SAP 15 SP4, SLES for SAP 15 SP3, SLES for SAP 15 SP2 +14 more 6.10.0-150200.11.6.2
- netty3 SLES for SAP 15 SP4, SLES for SAP 15 SP3, SLES for SAP 15 SP2 +12 more 3.10.6-150200.3.13.2
- xalan-j2 SLES for SAP 15 SP4, SLES for SAP 15 SP3, SLES for SAP 15 SP2 +14 more 2.7.3-150200.11.7.1
- xerces-j2 SLES for SAP 15 SP4, SLES for SAP 15 SP3, SLES for SAP 15 SP2 +14 more 2.12.2-150200.3.10.2
- xalan-j2-extras openSUSE Leap 15.6, openSUSE Leap 15.5 2.7.3-150200.11.7.1
- apache-commons-lang3 SLES for SAP 15 SP4, SLES for SAP 15 SP3, SLES for SAP 15 SP2 +13 more 3.16.0-150200.3.9.2
- java-1_8_0-ibm SLES for SAP 15 SP2, SLES for SAP 15 SP1, SLES for SAP 15 +13 more 1.8.0_sr7.20-150000.3.65.1
suse advisories SUSE-RU-2024:3971-1SUSE-SU-2022:4166-1SUSE-SU-2022:3152-1SUSE-SU-2022:3092-1SUSE-SU-2022:2949-1SUSE-SU-2022:2899-1
- rubygem-nokogiri openSUSE Tumbleweed 1.18.9-1.4
- java-11-openj9 Package Hub 15 SP6, openSUSE Leap 15.6 11.0.26.0-bp156.4.3.1
- rubygem-nokogiri openSUSE Tumbleweed 1.18.2-1.1
- rubygem-nokogiri openSUSE Tumbleweed 1.15.5-1.5
- java-13-openjdk openSUSE Tumbleweed 13.0.12.0-1.1
- java-15-openjdk openSUSE Tumbleweed 15.0.8.0-1.1
- java-18-openjdk openSUSE Tumbleweed 18.0.2.0-1.1
- java-11-openjdk openSUSE Tumbleweed 11.0.16.0-1.1
opensuse advisories openSUSE-SU-2026:10356-1openSUSE-SU-2025:0066-1openSUSE-SU-2025:14697-1openSUSE-SU-2024:14174-1openSUSE-SU-2024:12201-1openSUSE-SU-2024:12202-1
- java-17-openjdk AlmaLinux 9 1:17.0.4.0.8-2.el9_0
- java-17-openjdk-src AlmaLinux 9 1:17.0.4.0.8-2.el9_0
- java-17-openjdk-demo AlmaLinux 9 1:17.0.4.0.8-2.el9_0
- java-17-openjdk-jmods AlmaLinux 9 1:17.0.4.0.8-2.el9_0
- java-17-openjdk-javadoc AlmaLinux 9 1:17.0.4.0.8-2.el9_0
- java-17-openjdk-headless AlmaLinux 9 1:17.0.4.0.8-2.el9_0
- java-17-openjdk-fastdebug AlmaLinux 9 1:17.0.4.0.8-2.el9_0
- java-17-openjdk-slowdebug AlmaLinux 9 1:17.0.4.0.8-2.el9_0
almalinux advisories ALSA-2022:5736ALSA-2022:5695ALSA-2022:5696ALSA-2022:5709ALSA-2022:5683
- java-17-openjdk Rocky Linux 8 1:17.0.4.0.8-2.el8_6
- java-1.8.0-openjdk Rocky Linux 8 1:1.8.0.342.b07-2.el8_6
- java-11-openjdk Rocky Linux 8 1:11.0.16.0.8-1.el8_6
rocky linux advisories RLSA-2022:5726RLSA-2022:5696RLSA-2022:5683
- openjdk8 Alpine 3.24, Alpine 3.23, Alpine 3.22 +7 more 8.345.01-r0
- openjdk11 Alpine 3.15 11.0.17_p8-r0
- openjdk11 Alpine 3.24, Alpine 3.23, Alpine 3.22 +6 more 11.0.16_p8-r0
- openjdk13 Alpine 3.18, Alpine 3.17, Alpine 3.16 13.0.12_p4-r0
- openjdk15 Alpine 3.18, Alpine 3.17, Alpine 3.16 15.0.8_p4-r0
- openjdk17 Alpine 3.24, Alpine 3.23, Alpine 3.22 +6 more 17.0.4_p8-r0
alpine advisories ALPINE-CVE-2022-34169
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- gitbox.apache.org/repos/asf?p=xalan-java.git;a=commit;h=da3e0d06b467247643ce… commit
- gitbox.apache.org/repos/asf?p=xalan-java.git;a=commit;h=ab57211e5d2e97cbed06… commit
- gitbox.apache.org/repos/asf?p=xalan-java.git;a=commit;h=2e60d0a9a5b822c4abf9… commit
- oracle.com/security-alerts/cpujul2022.html advisory
- openwall.com/lists/oss-security/2022/07/20/3 advisory
- openwall.com/lists/oss-security/2022/10/18/2 advisory
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2022-34169 updated cvss 7.5
OpenJDK: integer truncation issue in Xalan-J (JAXP, 8285407)
-
Red Hat Migration Toolkit for Applications 6 xalanaffected: no fix planned “Will not fix”
-
Red Hat build of Apache Camel 4 for Quarkus 3 xalan Red Hat build of Apache Camel for Spring Boot 3 xalan Red Hat Build of Keycloak xalan Red Hat build of OptaPlanner 8 xalanaffected: no fix available
-
Red Hat Enterprise Linux 6 java-1.6.0-openjdk, java-1.7.0-openjdk, java-1.8.0-openjdk, java-1.6.0-openjdk-src, java-1.7.0-openjdk-src, java-1.8.0-openjdk-src, +7 more Red Hat Enterprise Linux 7 java-1.6.0-openjdk, java-1.7.0-openjdk, java-1.6.0-openjdk-src, java-1.7.0-openjdk-src, java-1.6.0-openjdk-demo, java-1.7.0-openjdk-demo, +4 moreaffected: no fix planned “Out of support scope”
-
Red Hat Fuse 7 xalan Red Hat JBoss Data Grid 7 xalanaffected: no fix planned “Will not fix”
-
Red Hat JBoss Enterprise Application Platform Expansion Pack xalanaffected: no fix available
-
Red Hat streams for Apache Kafka xalanaffected: no fix planned “Will not fix”
-
Red Hat build of Apache Camel 3.20.6 for Spring Bootfixed: vendor fix RHSA-2024:3708
-
Red Hat Build of OpenJDK 8u342fixed: vendor fix RHSA-2022:5754
show 22 moreshow fewer
-
Red Hat Build of OpenJDK 11.0.16fixed: vendor fix RHSA-2022:5755
-
Red Hat Build of OpenJDK 17.0.4fixed: vendor fix RHSA-2022:5757
-
Red Hat CodeReady Linux Builder (v. 9) java-17-openjdk-fastdebug 17.0.4.0.8-2.el9_0, java-17-openjdk-slowdebug 17.0.4.0.8-2.el9_0, java-11-openjdk-fastdebug 11.0.16.0.8-1.el9_0, java-11-openjdk-slowdebug 11.0.16.0.8-1.el9_0, java-17-openjdk-src-fastdebug 17.0.4.0.8-2.el9_0, java-17-openjdk-src-slowdebug 17.0.4.0.8-2.el9_0, +32 morefixed: vendor fix RHSA-2022:5709
-
Red Hat Enterprise Linux AppStream (v. 8) java-17-openjdk 17.0.4.0.8-2.el8_6, java-11-openjdk 11.0.16.0.8-1.el8_6, java-17-openjdk-src 17.0.4.0.8-2.el8_6, java-11-openjdk-src 11.0.16.0.8-1.el8_6, java-17-openjdk-demo 17.0.4.0.8-2.el8_6, java-1.8.0-openjdk 1.8.0.342.b07-2.el8_6, +17 morefixed: vendor fix RHSA-2022:5696
-
Red Hat Enterprise Linux AppStream (v. 9) java-17-openjdk 17.0.4.0.8-2.el9_0, java-11-openjdk 11.0.16.0.8-1.el9_0, java-17-openjdk-src 17.0.4.0.8-2.el9_0, java-11-openjdk-src 11.0.16.0.8-1.el9_0, java-17-openjdk-demo 17.0.4.0.8-2.el9_0, java-1.8.0-openjdk 1.8.0.342.b07-1.el9_0, +16 morefixed: vendor fix RHSA-2022:5709
-
Red Hat Enterprise Linux AppStream E4S (v. 8.1) java-11-openjdk 11.0.16.0.8-1.el8_1, java-11-openjdk-src 11.0.16.0.8-1.el8_1, java-1.8.0-openjdk 1.8.0.342.b07-1.el8_1, java-11-openjdk-demo 11.0.16.0.8-1.el8_1, java-11-openjdk-jmods 11.0.16.0.8-1.el8_1, java-11-openjdk-javadoc 11.0.16.0.8-1.el8_1, +8 morefixed: vendor fix RHSA-2022:5701
-
Red Hat Enterprise Linux AppStream EUS (v. 8.2) java-11-openjdk 11.0.16.0.8-1.el8_2, java-11-openjdk-src 11.0.16.0.8-1.el8_2, java-1.8.0-openjdk 1.8.0.342.b07-1.el8_2, java-11-openjdk-demo 11.0.16.0.8-1.el8_2, java-11-openjdk-jmods 11.0.16.0.8-1.el8_2, java-11-openjdk-javadoc 11.0.16.0.8-1.el8_2, +9 morefixed: vendor fix RHSA-2022:5700
-
Red Hat Enterprise Linux AppStream EUS (v.8.4) java-11-openjdk 11.0.16.0.8-1.el8_4, java-11-openjdk-src 11.0.16.0.8-1.el8_4, java-1.8.0-openjdk 1.8.0.342.b07-1.el8_4, java-11-openjdk-demo 11.0.16.0.8-1.el8_4, java-11-openjdk-jmods 11.0.16.0.8-1.el8_4, java-11-openjdk-javadoc 11.0.16.0.8-1.el8_4, +9 morefixed: vendor fix RHSA-2022:5697
-
Red Hat Enterprise Linux Client (v. 7) java-11-openjdk 11.0.16.0.8-1.el7_9, java-1.8.0-openjdk 1.8.0.342.b07-1.el7_9, java-11-openjdk-headless 11.0.16.0.8-1.el7_9, java-1.8.0-openjdk-headless 1.8.0.342.b07-1.el7_9 Red Hat Enterprise Linux Client Optional (v. 7) java-11-openjdk-src 11.0.16.0.8-1.el7_9, java-11-openjdk-demo 11.0.16.0.8-1.el7_9, java-11-openjdk-jmods 11.0.16.0.8-1.el7_9, java-11-openjdk-javadoc 11.0.16.0.8-1.el7_9, java-1.8.0-openjdk-src 1.8.0.342.b07-1.el7_9, java-1.8.0-openjdk-demo 1.8.0.342.b07-1.el7_9, +5 more Red Hat Enterprise Linux ComputeNode Optional (v. 7) java-11-openjdk-src 11.0.16.0.8-1.el7_9, java-11-openjdk-demo 11.0.16.0.8-1.el7_9, java-11-openjdk-jmods 11.0.16.0.8-1.el7_9, java-11-openjdk-javadoc 11.0.16.0.8-1.el7_9, java-1.8.0-openjdk-src 1.8.0.342.b07-1.el7_9, java-1.8.0-openjdk-demo 1.8.0.342.b07-1.el7_9, +5 morefixed: vendor fix RHSA-2022:5698
-
Red Hat Enterprise Linux CRB (v. 8) java-17-openjdk-fastdebug 17.0.4.0.8-2.el8_6, java-17-openjdk-slowdebug 17.0.4.0.8-2.el8_6, java-11-openjdk-fastdebug 11.0.16.0.8-1.el8_6, java-11-openjdk-slowdebug 11.0.16.0.8-1.el8_6, java-17-openjdk-src-fastdebug 17.0.4.0.8-2.el8_6, java-17-openjdk-src-slowdebug 17.0.4.0.8-2.el8_6, +34 morefixed: vendor fix RHSA-2022:5696
-
Red Hat Enterprise Linux CRB EUS (v.8.4) java-11-openjdk-fastdebug 11.0.16.0.8-1.el8_4, java-11-openjdk-slowdebug 11.0.16.0.8-1.el8_4, java-11-openjdk-src-fastdebug 11.0.16.0.8-1.el8_4, java-11-openjdk-src-slowdebug 11.0.16.0.8-1.el8_4, java-1.8.0-openjdk-fastdebug 1.8.0.342.b07-1.el8_4, java-1.8.0-openjdk-slowdebug 1.8.0.342.b07-1.el8_4, +20 morefixed: vendor fix RHSA-2022:5697
-
Red Hat Enterprise Linux Server (v. 7) java-11-openjdk 11.0.16.0.8-1.el7_9, java-1.8.0-openjdk 1.8.0.342.b07-1.el7_9, java-11-openjdk-headless 11.0.16.0.8-1.el7_9, java-1.8.0-openjdk-headless 1.8.0.342.b07-1.el7_9 Red Hat Enterprise Linux Server Optional (v. 7) java-11-openjdk-src 11.0.16.0.8-1.el7_9, java-11-openjdk-demo 11.0.16.0.8-1.el7_9, java-11-openjdk-jmods 11.0.16.0.8-1.el7_9, java-11-openjdk-javadoc 11.0.16.0.8-1.el7_9, java-1.8.0-openjdk-src 1.8.0.342.b07-1.el7_9, java-1.8.0-openjdk-demo 1.8.0.342.b07-1.el7_9, +5 more Red Hat Enterprise Linux Workstation (v. 7) java-11-openjdk 11.0.16.0.8-1.el7_9, java-1.8.0-openjdk 1.8.0.342.b07-1.el7_9, java-11-openjdk-headless 11.0.16.0.8-1.el7_9, java-1.8.0-openjdk-headless 1.8.0.342.b07-1.el7_9 Red Hat Enterprise Linux Workstation Optional (v. 7) java-11-openjdk-src 11.0.16.0.8-1.el7_9, java-11-openjdk-demo 11.0.16.0.8-1.el7_9, java-11-openjdk-jmods 11.0.16.0.8-1.el7_9, java-11-openjdk-javadoc 11.0.16.0.8-1.el7_9, java-1.8.0-openjdk-src 1.8.0.342.b07-1.el7_9, java-1.8.0-openjdk-demo 1.8.0.342.b07-1.el7_9, +5 morefixed: vendor fix RHSA-2022:5698
-
Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-jsoup 1.15.4-1.redhat_00003.1.el7eap, eap7-xalan-j2 2.7.1-37.redhat_00015.1.el7eap, eap7-wildfly 7.4.19-1.GA_redhat_00002.1.el7eap, eap7-jboss-cert-helper 1.1.3-1.redhat_00001.1.el7eap, eap7-hal-console 3.3.24-1.Final_redhat_00001.1.el7eap, eap7-ironjacamar 1.5.18-1.Final_redhat_00001.1.el7eap, +21 morefixed: vendor fix RHSA-2024:8075
-
Red Hat JBoss EAP 7.4 for RHEL 8 eap7-jsoup 1.15.4-1.redhat_00003.1.el8eap, eap7-xalan-j2 2.7.1-37.redhat_00015.1.el8eap, eap7-wildfly 7.4.19-1.GA_redhat_00002.1.el8eap, eap7-jboss-cert-helper 1.1.3-1.redhat_00001.1.el8eap, eap7-hal-console 3.3.24-1.Final_redhat_00001.1.el8eap, eap7-ironjacamar 1.5.18-1.Final_redhat_00001.1.el8eap, +22 morefixed: vendor fix RHSA-2024:8076
-
Red Hat JBoss EAP 7.4 for RHEL 9 eap7-jsoup 1.15.4-1.redhat_00003.1.el9eap, eap7-xalan-j2 2.7.1-37.redhat_00015.1.el9eap, eap7-wildfly 7.4.19-1.GA_redhat_00002.1.el9eap, eap7-jboss-cert-helper 1.1.3-1.redhat_00001.1.el9eap, eap7-hal-console 3.3.24-1.Final_redhat_00001.1.el9eap, eap7-ironjacamar 1.5.18-1.Final_redhat_00001.1.el9eap, +22 morefixed: vendor fix RHSA-2024:8077
-
Red Hat JBoss EAP 8.0 for RHEL 8 eap8-hppc 0.8.1-2.redhat_00001.1.el8eap, eap8-log4j 2.22.1-1.redhat_00002.1.el8eap, eap8-slf4j 2.0.16-1.redhat_00001.1.el8eap, eap8-jctools 4.0.2-1.redhat_00001.1.el8eap, eap8-asyncutil 0.1.0-2.redhat_00010.1.el8eap, eap8-saaj-impl 3.0.4-1.redhat_00001.1.el8eap, +74 morefixed: vendor fix RHSA-2024:8823
-
Red Hat JBoss EAP 8.0 for RHEL 9 eap8-hppc 0.8.1-2.redhat_00001.1.el9eap, eap8-log4j 2.22.1-1.redhat_00002.1.el9eap, eap8-slf4j 2.0.16-1.redhat_00001.1.el9eap, eap8-jctools 4.0.2-1.redhat_00001.1.el9eap, eap8-asyncutil 0.1.0-2.redhat_00010.1.el9eap, eap8-saaj-impl 3.0.4-1.redhat_00001.1.el9eap, +74 morefixed: vendor fix RHSA-2024:8824
-
Red Hat JBoss Enterprise Application Platform xalan 2.7.1.redhat-00015fixed: vendor fix RHSA-2024:8080
-
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-avro 1.7.6-2.redhat_00003.1.ep7.el7, eap7-xalan-j2 2.7.1-26.redhat_00015.1.ep7.el7, eap7-wildfly 7.1.8-2.GA_redhat_00002.1.ep7.el7, eap7-h2database 1.4.197-2.redhat_00005.1.ep7.el7, eap7-bouncycastle 1.68.0-1.redhat_00005.1.ep7.el7, eap7-apache-cxf 3.1.16-3.SP1_redhat_00001.1.ep7.el7, +11 morefixed: vendor fix RHSA-2024:10208
-
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-avro 1.7.6-8.redhat_00003.1.el7eap, eap7-wss4j 2.3.3-2.redhat_00001.1.el7eap, eap7-xalan-j2 2.7.1-38.redhat_00015.1.el7eap, eap7-wildfly 7.3.11-4.GA_redhat_00002.1.el7eap, eap7-h2database 1.4.197-3.redhat_00004.1.el7eap, eap7-wss4j-policy 2.3.3-2.redhat_00001.1.el7eap, +41 morefixed: vendor fix RHSA-2024:10207
-
Red Hat JBoss Enterprise Application Platform 8fixed: vendor fix RHSA-2024:8826
-
Red Hat Migration Toolkit for Runtimes xalannot affected: vulnerable code not present
9 more not affected in the full advisory
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 17 mo ago
Exploit prediction
81.76% chance of exploitation in the next 30 days, higher than 99.6% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| OSV | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | xalan:xalan | <2.7.3 |
2.7.3 |
| bitnami | java | >=1.8.0-333, <=1.8.0-333 >=11.0.15-1, <=11.0.15-1 >=17.0.3-1, <=17.0.3-1 |
no fix listed |
| bitnami | java-min | >=1.8.0-333, <=1.8.0-333 >=11.0.15-1, <=11.0.15-1 >=17.0.3-1, <=17.0.3-1 |
no fix listed |
| bitnami | jre | >=1.8.0-333, <=1.8.0-333 >=11.0.15-1, <=11.0.15-1 >=17.0.3-1, <=17.0.3-1 |
no fix listed |
Affected products
- Apache Software Foundation Apache Xalan-J
Classification
- Weakness
-
- CWE-681 Incorrect Conversion between Numeric Types
References
-
oracle.com
/security-alerts/cpujul2022.html
web, patch, third-party-advisory, advisory
-
openwall.com
/lists/oss-security/2022/07/20/3
mailing-list, web, patch, third-party-advisory, advisory
-
openwall.com
/lists/oss-security/2022/10/18/2
mailing-list, web, patch, third-party-advisory, advisory
-
gitbox.apache.org
/repos/asf?p=xalan-java.git;a=commit;h=da3e0d06b467247643ce04e88d3346739d119f21
web
-
gitbox.apache.org
/repos/asf?p=xalan-java.git;a=commit;h=ab57211e5d2e97cbed06786f919fa9b749c83573
web
-
gitbox.apache.org
/repos/asf?p=xalan-java.git;a=commit;h=2e60d0a9a5b822c4abf9051857973b1c6babfe81
web
-
debian.org
/security/2022/dsa-5188
vendor-advisory, web, third-party-advisory, advisory
-
debian.org
/security/2022/dsa-5192
vendor-advisory, web, third-party-advisory, advisory
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/KO3DXNKZ4EU3UZBT6AAR4XRKCD73KLMO/
vendor-advisory, web
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/JN3EVGR7FD3ZLV5SBTJXUIDCMSK4QUE2/
vendor-advisory, web
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/YULPNO3PAWMEQQZV2C54I3H3ZOXFZUTB/
vendor-advisory, web
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/I5OZNAZJ4YHLOKRRRZSWRT5OJ25E4XLM/
vendor-advisory, web
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/L3XPOTPPBZIPFBZHQE5E7OW6PDACUMCJ/
vendor-advisory, web
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/H4YNJSJ64NPCNKFPNBYITNZU5H3L4D6L/
vendor-advisory, web
-
debian.org
/security/2022/dsa-5256
vendor-advisory, web, third-party-advisory, advisory
-
lists.apache.org
/thread/2qvl7r43wb4t8p9dd9om1bnkssk07sn8
web, issue-tracking, mailing-list, vendor-advisory, advisory
-
lists.apache.org
/thread/12pxy4phsry6c34x2ol4fft6xlho4kyw
web, issue-tracking, mailing-list, vendor-advisory, advisory
-
openwall.com
/lists/oss-security/2022/07/19/5
mailing-list, web, third-party-advisory, advisory
-
openwall.com
/lists/oss-security/2022/07/19/6
mailing-list, web, third-party-advisory, advisory
-
openwall.com
/lists/oss-security/2022/07/20/2
mailing-list, web, third-party-advisory, advisory
-
security.netapp.com
/advisory/ntap-20220729-0009/
third-party-advisory, advisory
-
packetstormsecurity.com
/files/168186/Xalan-J-XSLTC-Integer-Truncation.html
web, third-party-advisory, vdb-entry, advisory
-
lists.debian.org
/debian-lts-announce/2022/10/msg00024.html
mailing-list, web, third-party-advisory, advisory
-
openwall.com
/lists/oss-security/2022/11/04/8
mailing-list, web, third-party-advisory, advisory
-
openwall.com
/lists/oss-security/2022/11/07/2
mailing-list, web, third-party-advisory, advisory
-
security.gentoo.org
/glsa/202401-25
web
-
security.netapp.com
/advisory/ntap-20240621-0006/
web
-
nvd.nist.gov
/vuln/detail/CVE-2022-34169
advisory, web
-
xalan.apache.org
web
-
security.netapp.com
/advisory/ntap-20240621-0006
web
-
security.netapp.com
/advisory/ntap-20220729-0009
web
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/YULPNO3PAWMEQQZV2C54I3H3ZOXFZUTB
web
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/L3XPOTPPBZIPFBZHQE5E7OW6PDACUMCJ
web
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/KO3DXNKZ4EU3UZBT6AAR4XRKCD73KLMO
web
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/JN3EVGR7FD3ZLV5SBTJXUIDCMSK4QUE2
web
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/I5OZNAZJ4YHLOKRRRZSWRT5OJ25E4XLM
web
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/H4YNJSJ64NPCNKFPNBYITNZU5H3L4D6L
web
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/YULPNO3PAWMEQQZV2C54I3H3ZOXFZUTB
web
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/L3XPOTPPBZIPFBZHQE5E7OW6PDACUMCJ
web
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/KO3DXNKZ4EU3UZBT6AAR4XRKCD73KLMO
web
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/JN3EVGR7FD3ZLV5SBTJXUIDCMSK4QUE2
web
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/I5OZNAZJ4YHLOKRRRZSWRT5OJ25E4XLM
web
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/H4YNJSJ64NPCNKFPNBYITNZU5H3L4D6L
web
-
lists.apache.org
/thread/x3f7xv3p1g32qj2hlg8wd57pwcpld471
web
-
gitbox.apache.org
/repos/asf?p=xalan-java.git
package
Sources
- CVE List CVE-2022-34169
- GitHub Advisory GHSA-9339-86wc-4qgf
- NVD CVE-2022-34169
- OSV BIT-java-2022-34169
- OSV BIT-java-min-2022-34169
- OSV BIT-jre-2022-34169
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.