Bug 2182183 (CVE-2022-42890)

Summary:	CVE-2022-42890 batik: Untrusted code execution in Apache XML Graphics Batik
Product:	[Other] Security Response	Reporter:	Patrick Del Bello <pdelbell>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aileenc, alampare, alazarot, chazlett, dhanak, emingora, fmongiar, gjospin, gmalinko, hbraun, ibek, janstey, jnethert, jpavlik, jpoth, jrokos, kverlaen, lbacciot, mnovotny, pdelbell, peholase, pjindal, rguimara, rrajasek, tcunning, yfang
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	org.apache.xmlgraphics batik 1.16	Doc Type:	---
Doc Text:	A flaw was found in Batik of Apache XML Graphics. This issue may allow a malicious user to run Java code from untrusted SVG via JavaScript.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-05-03 19:48:03 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2137544

Description Patrick Del Bello 2023-03-27 19:36:38 UTC

A vulnerability in Batik of Apache XML Graphics allows an attacker to run Java code from untrusted SVG via JavaScript. This issue affects Apache XML Graphics prior to 1.16. Users are recommended to upgrade to version 1.16.

https://lists.apache.org/thread/pkvhy0nsj1h1mlon008wtzhosbtxjwly
http://www.openwall.com/lists/oss-security/2022/10/25/3
https://lists.debian.org/debian-lts-announce/2022/10/msg00038.html
https://www.debian.org/security/2022/dsa-5264

Comment 2 errata-xmlrpc 2023-05-03 14:07:10 UTC

This issue has been addressed in the following products:

  RHINT Camel-Springboot 3.20.1

Via RHSA-2023:2100 https://access.redhat.com/errata/RHSA-2023:2100

Comment 3 Product Security DevOps Team 2023-05-03 19:48:01 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-42890

Comment 4 errata-xmlrpc 2023-06-29 20:08:33 UTC

This issue has been addressed in the following products:

  Red Hat Fuse 7.12

Via RHSA-2023:3954 https://access.redhat.com/errata/RHSA-2023:3954