Bug 2182182 (CVE-2022-41704)

Summary:	CVE-2022-41704 batik: Apache XML Graphics Batik vulnerable to code execution via SVG
Product:	[Other] Security Response	Reporter:	Patrick Del Bello <pdelbell>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aileenc, alampare, alazarot, chazlett, dhanak, emingora, fmongiar, gjospin, gmalinko, hbraun, ibek, janstey, jnethert, jpavlik, jpoth, jrokos, kverlaen, lbacciot, mnovotny, pdelbell, peholase, pjindal, rguimara, rrajasek, tcunning, yfang
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	org.apache.xmlgraphics batik 1.16	Doc Type:	---
Doc Text:	A flaw was found in Batik. This issue may allow a malicious user to run untrusted Java code from an SVG.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-05-03 19:46:57 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2137544

Description Patrick Del Bello 2023-03-27 19:36:36 UTC

A vulnerability in Batik of Apache XML Graphics allows an attacker to run untrusted Java code from an SVG. This issue affects Apache XML Graphics prior to 1.16. It is recommended to update to version 1.16.

https://lists.apache.org/thread/hplhx0o74jb7blj39fm4kw3otcnjd6xf
http://www.openwall.com/lists/oss-security/2022/10/25/2
https://lists.debian.org/debian-lts-announce/2022/10/msg00038.html
https://www.debian.org/security/2022/dsa-5264

Comment 2 errata-xmlrpc 2023-05-03 14:07:06 UTC

This issue has been addressed in the following products:

  RHINT Camel-Springboot 3.20.1

Via RHSA-2023:2100 https://access.redhat.com/errata/RHSA-2023:2100

Comment 3 Product Security DevOps Team 2023-05-03 19:46:54 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-41704

Comment 4 errata-xmlrpc 2023-06-29 20:08:31 UTC

This issue has been addressed in the following products:

  Red Hat Fuse 7.12

Via RHSA-2023:3954 https://access.redhat.com/errata/RHSA-2023:3954