CVE-2022-42920 json
Apache Commons BCEL prior to 6.6.0 allows producing arbitrary bytecode via out-of-bounds writing
published 2022-11-07 4 y ago modified 2026-06-17 4 mo ago also GHSA-97xg-phpr-rg8q , EUVD-2022-7295
- cvss
- 9.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 3.5%
- EPSS 3.5% chance of exploitation in 30 days, percentile 89%
- public exploits
- 0
- none known
Summary
Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds writing issue, these APIs can be used to produce arbitrary bytecode. This could be abused in applications that pass attacker-controllable data to those APIs, giving the attacker more control over the resulting bytecode than otherwise expected. Update to Apache Commons BCEL 6.6.0.
Patch / fix
- maven org.apache.bcel:bcel 6.6.0
- Apache Software Foundation Apache Commons BCEL 6.6.0
- bcel Debian 14, Debian 13, Debian 12 6.5.0-2
debian advisories DEBIAN-CVE-2022-42920
- bcel Ubuntu 22.04 LTS 6.5.0-1ubuntu0.1
- bcel Ubuntu Pro 16.04 LTS 6.0~rc3-2ubuntu1+esm1
- bcel Ubuntu Pro 18.04 LTS 6.2-1ubuntu0.1~esm1
- bcel Ubuntu Pro 20.04 LTS 6.4.1-1ubuntu0.1~esm1
ubuntu advisories UBUNTU-CVE-2022-42920
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- bcel RHEL 7 5.2-19.el7_9
- bcel-javadoc RHEL 7 5.2-19.el7_9
- bcel RHEL 9 6.4.1-9.el9_1
- rh-maven36-bcel RHEL 3 SOFTWARE_COLLECTIONS 6.3.1-2.3.el7
- rh-maven36-bcel-javadoc RHEL 3 SOFTWARE_COLLECTIONS 6.3.1-2.3.el7
- bcel RHEL 9.0 EUS 6.4.1-9.el9_0
red hat advisories RHSA-2023:0004RHSA-2022:8958RHSA-2023:0005RHSA-2022:8959
- bcel SLES for SAP 12 SP5, SLES 12 SP5 5.2-28.3.1
- bcel SLE Module for Basesystem 15 SP4, SLE Module for Basesystem 15 SP3, openSUSE Leap 15.4 +1 more 5.2-150200.11.3.1
suse advisories SUSE-SU-2022:4331-1SUSE-SU-2022:4306-1
- bcel openSUSE Tumbleweed 5.2-37.1
opensuse advisories openSUSE-SU-2024:12530-1
- bcel AlmaLinux 9 6.4.1-9.el9_1
almalinux advisories ALSA-2023:0005
- bcel Rocky Linux 9 6.4.1-9.el9_1
rocky linux advisories RLSA-2023:0005
- github.com/apache/commons-bcel#147 pull request
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2022-42920 updated cvss 8.1
Apache-Commons-BCEL: arbitrary bytecode produced via out-of-bounds writing
-
Red Hat Migration Toolkit for Applications 6 org.jboss.windup-windup-cli-parent Red Hat Migration Toolkit for Runtimes org.jboss.windup-windup-cli-parent, org.jboss.windup.rules-windup-rulesets, org.jboss.windup.web-windup-web-parent, org.jboss.windup.plugin-windup-maven-plugin, org.jboss.windup.rules-windup-rulesets-parent, org.jboss.windup.plugin-windup-maven-plugin-parentaffected: no fix available
-
Red Hat JBoss Data Grid 7 apache-bcel Red Hat JBoss Enterprise Application Platform 6 bcelaffected: no fix planned “Out of support scope”
-
Red Hat JBoss Enterprise Application Platform 7 bcelaffected: no fix available
-
Red Hat JBoss Fuse 6 apache-bcel Red Hat JBoss Fuse Service Works 6 apache-bcelaffected: no fix planned “Out of support scope”
-
Red Hat Single Sign-On 7 apache-bcelaffected: no fix available
-
Red Hat Migration Toolkit for Runtimes 1 on RHEL 8 mtr/mtr-rhel8-operator 1.0-10, mtr/mtr-operator-bundle 1.0-30, mtr/mtr-web-container-rhel8 1.0-15, mtr/mtr-web-executor-container-rhel8 1.0-14fixed: vendor fix RHSA-2023:0470
-
Red Hat MTA 6.0 for RHEL 8 mta/mta-ui-rhel8 6.0.1-10fixed: vendor fix RHSA-2023:0934
-
Red Hat AMQ Streams 2.7.0fixed: vendor fix RHSA-2024:3527
show 7 moreshow fewer
-
Red Hat Enterprise Linux AppStream (v. 9) bcel 6.4.1-9.el9_1fixed: vendor fix RHSA-2023:0005
-
Red Hat Enterprise Linux AppStream EUS (v.9.0) bcel 6.4.1-9.el9_0fixed: vendor fix RHSA-2023:0004
-
Red Hat Enterprise Linux Client Optional (v. 7) bcel 5.2-19.el7_9, bcel-javadoc 5.2-19.el7_9 Red Hat Enterprise Linux ComputeNode Optional (v. 7) bcel 5.2-19.el7_9, bcel-javadoc 5.2-19.el7_9 Red Hat Enterprise Linux Server (v. 7) bcel 5.2-19.el7_9 Red Hat Enterprise Linux Server Optional (v. 7) bcel 5.2-19.el7_9, bcel-javadoc 5.2-19.el7_9 Red Hat Enterprise Linux Workstation (v. 7) bcel 5.2-19.el7_9 Red Hat Enterprise Linux Workstation Optional (v. 7) bcel-javadoc 5.2-19.el7_9fixed: vendor fix RHSA-2022:8958
-
Red Hat Fuse 7.12fixed: vendor fix RHSA-2023:3954
-
Red Hat Software Collections for RHEL Workstation(v. 7) rh-maven36-bcel 6.3.1-2.3.el7, rh-maven36-bcel-javadoc 6.3.1-2.3.el7 Red Hat Software Collections for RHEL(v. 7) rh-maven36-bcel 6.3.1-2.3.el7, rh-maven36-bcel-javadoc 6.3.1-2.3.el7fixed: vendor fix RHSA-2022:8959
-
Red Hat RHPAM 7.13.4 asyncfixed: vendor fix RHSA-2023:4983
-
Red Hat MTA 6.0 for RHEL 8 mta/mta-hub-rhel8 6.0.1-8, mta/mta-pathfinder-rhel8 6.0.1-6, mta/mta-admin-addon-rhel8 6.0.1-8, mta/mta-windup-addon-rhel8 6.0.1-9 Red Hat Data Grid 8 apache-bcel Red Hat Integration Camel K 1 apache-bcel Red Hat JBoss Enterprise Application Platform Expansion Pack bcelnot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
3.50% chance of exploitation in the next 30 days, higher than 89% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.bcel:bcel | <6.6.0 |
6.6.0 |
Affected products
- Apache Software Foundation Apache Commons BCEL
Classification
- Weakness
-
- CWE-787 Out-of-bounds Write
References
-
github.com
/apache/commons-bcel/pull/147
web
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/LX3HEB4TV2BVCGDTK5BCLSYOZNQTOBN4/
vendor-advisory
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/QMVX6COVXZVS5GPWDODIRW6Z2GE7RPAQ/
vendor-advisory
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/QAMRHAKGIKZNHRBB4VLYTOIOIMMXCUCD/
vendor-advisory
-
security.gentoo.org
/glsa/202401-25
vendor-advisory, web
-
lists.apache.org
/thread/lfxk7q8qmnh5bt9jm6nmjlv5hsxjhrz4
web, mailing-list, vendor-advisory
-
openwall.com
/lists/oss-security/2022/11/07/2
mailing-list, web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2022-42920
advisory
-
github.com
/apache/commons-bcel
package
-
issues.apache.org
/jira/browse/BCEL-363
web
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/LX3HEB4TV2BVCGDTK5BCLSYOZNQTOBN4
web
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/QAMRHAKGIKZNHRBB4VLYTOIOIMMXCUCD
web
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/QMVX6COVXZVS5GPWDODIRW6Z2GE7RPAQ
web
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/LX3HEB4TV2BVCGDTK5BCLSYOZNQTOBN4
web
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/QAMRHAKGIKZNHRBB4VLYTOIOIMMXCUCD
web
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/QMVX6COVXZVS5GPWDODIRW6Z2GE7RPAQ
web
Sources
- CVE List CVE-2022-42920
- GitHub Advisory GHSA-97xg-phpr-rg8q
- NVD CVE-2022-42920
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.