oss-security - [CVE-2022-44730] Apache Batik information disclosure vulnerability

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <001601d9d4cf$66c49ba0$344dd2e0$@gmail.com>
Date: Tue, 22 Aug 2023 09:05:22 +0100
From: "Simon Steiner" <simonsteiner1984@...il.com>
To: <general@...graphics.apache.org>,
	<batik-dev@...graphics.apache.org>,
	<batik-users@...graphics.apache.org>,
	"'Apache Security Team'" <security@...che.org>,
	<oss-security@...ts.openwall.com>
Subject: [CVE-2022-44730] Apache Batik information disclosure vulnerability

CVE-2022-44730:
        Apache Batik information disclosure vulnerability

Severity:
        Medium

Vendor:
        The Apache Software Foundation

Versions Affected:
        Batik 1.0 - 1.16

Description:
        Switch to empty whitelist for rhino

Mitigation:
        Users should upgrade to Batik 1.17

Credit:
        This issue was independently reported by Julien Lacour

References:
        http://xmlgraphics.apache.org/security.html
        https://issues.apache.org/jira/browse/BATIK-1347

The Apache XML Graphics team.

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.