CVE-2022-34169 is a high-severity vulnerability affecting the Apache Xalan Java XSLT library, specifically versions up to and including 2.7.2. This vulnerability is caused by an integer truncation issue when processing malicious XSLT stylesheets, which can lead to the corruption of Java class files and execution of arbitrary Java bytecode.

How do I know if I'm affected?

If you're using the Apache Xalan Java XSLT library, you might be affected by this vulnerability. This issue can corrupt Java class files and execute arbitrary Java bytecode when processing malicious XSLT stylesheets. Affected versions include Xalan Java up to and including 2.7.2, Debian Linux 10.0 and 11.0, Oracle GraalVM 20.3.6, 21.3.2, and 22.1.0, Oracle JDK and JRE versions, Oracle OpenJDK 7, 8, and 18, Fedora 35 and 36, and NetApp software configurations. To know if you're affected, check the version of your software and see if it falls within these mentioned versions.

What should I do if I'm affected?

If you're affected by this vulnerability, it's important to update your software to a secure version. For example, if you're using Fedora 35, upgrade to java-latest-openjdk version 18.0.2.0.9-1.rolling.fc35. To do this, run the command su -c 'dnf upgrade --advisory FEDORA-2022-b76ab52e73'. Always keep your software up-to-date to stay protected.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

This vulnerability is not listed in CISA's Known Exploited Vulnerabilities Catalog. This vulnerability, found in the Apache Xalan Java XSLT library, involves an integer truncation issue when processing malicious XSLT stylesheets. It can lead to the corruption of Java class files and execution of arbitrary Java bytecode.

Weakness enumeration

The weakness enumeration for this vulnerability is categorized as CWE-681, involves an integer truncation issue in the Apache Xalan Java XSLT library, which can corrupt Java class files and execute arbitrary Java bytecode.

For more details

CVE-2022-34169 is a high-severity vulnerability affecting the Apache Xalan Java XSLT library, with potential consequences including corruption of Java class files and execution of arbitrary Java bytecode. To learn more about this vulnerability, including its description, severity, technical details, and known affected software configurations, visit the NVD page or the links below.

• oss-security - CVE-2022-34169: Apache Xalan Java XSLT library vulnerability

• oss-security - Re: CVE-2022-34169: Apache Xalan Java XSLT library vulnerability

• Apache Mail Archives - CVE-2022-34169: Apache Xalan Java XSLT library vulnerability

• Fedora 35 Update: java-latest-openjdk-18.0.2.0.9-1.rolling.fc35