Bug 859394 (CVE-2022-34169, CVE-2022-42920) – [Tracker] Remote code execution in dev-java/bcel

• Product: Gentoo Security
• Status: CONFIRMED ---

[Description John Helmert III 2022-07-19 19:26:31 UTC]

CVE-2022-34169 (https://lists.apache.org/thread/12pxy4phsry6c34x2ol4fft6xlho4kyw):
https://lists.apache.org/thread/2qvl7r43wb4t8p9dd9om1bnkssk07sn8

The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. The Apache Xalan Java project is dormant and in the process of being retired. No future releases of Apache Xalan Java to address this issue are expected. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.

Neither of these references seem to give substantial information on
the vulnerability so I've asked for more info on oss-security.

[Comment 1 John Helmert III 2022-10-18 20:49:05 UTC]

https://www.openwall.com/lists/oss-security/2022/10/18/2

"it appears the underlying bug is in Apache Commons bcel and not in Apache Xalan
itself. See

https://bugs.debian.org/1015860"

So I guess some of the dependencies here are invalid.

[Comment 2 John Helmert III 2022-11-07 17:24:32 UTC]

I guess Apache wants to keep the duplicates.

[Comment 3 John Helmert III 2022-11-08 19:33:58 UTC]

(In reply to John Helmert III from comment #2)
> I guess Apache wants to keep the duplicates.

Actually, they responded to my mail and will handle marking the duplicate as such \o/

[Comment 4 Larry the Git Cow 2023-09-19 11:12:11 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=3cc2f17cd66be72f77a9335d4e2588325a8d7367

commit 3cc2f17cd66be72f77a9335d4e2588325a8d7367
Author:     Volkmar W. Pogatzki <[e-mail]>
AuthorDate: 2023-09-06 22:59:28 +0000
Commit:     Miroslav Šulc <[e-mail]>
CommitDate: 2023-09-19 11:04:48 +0000

    dev-java/xalan: add 2.7.3 - CVE-2022-34169
    
    Bug: https://bugs.gentoo.org/859394
    Signed-off-by: Volkmar W. Pogatzki <[e-mail]>
    Closes: https://github.com/gentoo/gentoo/pull/32668
    Signed-off-by: Miroslav Šulc <[e-mail]>

 dev-java/xalan/Manifest           |  2 ++
 dev-java/xalan/xalan-2.7.3.ebuild | 45 +++++++++++++++++++++++++++++++++++++++
 2 files changed, 47 insertions(+)

[Comment 5 John Helmert III 2023-10-29 17:44:41 UTC]

(In reply to Larry the Git Cow from comment #4)
> The bug has been referenced in the following commit(s):
> 
> https://gitweb.gentoo.org/repo/gentoo.git/commit/
> ?id=3cc2f17cd66be72f77a9335d4e2588325a8d7367
> 
> commit 3cc2f17cd66be72f77a9335d4e2588325a8d7367
> Author:     Volkmar W. Pogatzki <[e-mail]>
> AuthorDate: 2023-09-06 22:59:28 +0000
> Commit:     Miroslav Šulc <[e-mail]>
> CommitDate: 2023-09-19 11:04:48 +0000
> 
>     dev-java/xalan: add 2.7.3 - CVE-2022-34169
>     
>     Bug: https://bugs.gentoo.org/859394
>     Signed-off-by: Volkmar W. Pogatzki <[e-mail]>
>     Closes: https://github.com/gentoo/gentoo/pull/32668
>     Signed-off-by: Miroslav Šulc <[e-mail]>
> 
>  dev-java/xalan/Manifest           |  2 ++
>  dev-java/xalan/xalan-2.7.3.ebuild | 45
> +++++++++++++++++++++++++++++++++++++++
>  2 files changed, 47 insertions(+)

We shouldn't be affected by this though, right? xalan depends on bcel, so shouldn't be using the vulnerable bundled bcel?

[Comment 6 Volkmar W. Pogatzki 2023-10-29 20:32:25 UTC]

(In reply to John Helmert III from comment #5)
> (In reply to Larry the Git Cow from comment #4)
> [...]
> We shouldn't be affected by this though, right? xalan depends on bcel, so
> shouldn't be using the vulnerable bundled bcel?

Right. There is bcel-6.7.0.jar in xalan{,-serializer}'s lib directory but ::gentoo does not use it.