CVE-2022-38648 PDFTranscoder does not block external resources

What is CVE-2022-38648?

CVE-2022-38648 is a medium-severity server-side request forgery vulnerability in Debian Debian Linux, published on 22 Sep 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources. This issue affects Apache XML Graphics Batik 1.14.

Weakness: CWE-918

Which versions are affected by CVE-2022-38648?

4 open source packages ship an affected version, including org.apache.xmlgraphics:batik and org.apache.xmlgraphics:batik-bridge. It affects 2 products.

Products include Apache Batik, Debian Debian Linux.

How do I fix CVE-2022-38648?

Upgrade org.apache.xmlgraphics:batik to 1.15 or later.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2022-38648 being exploited?

There is no known exploitation of CVE-2022-38648 in the wild and no public exploit code.

Other vulnerabilities in Debian Debian Linux

• CVE-2018-8013 Deserialization of Untrusted Data in Apache Batik Critical 9.8
• CVE-2020-11987 Server-side request forgery (SSRF) in Apache Batik High 8.2
• CVE-2022-41704 Apache Batik prior to 1.16 allows RCE when loading untrusted SVG input High 7.5
• CVE-2022-42890 Apache Batik prior to 1.16 allows RCE via scripting High 7.5
• CVE-2022-40146 Jar url should be blocked by DefaultScriptSecurity High 7.5

All Debian Debian Linux vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as CLSA-2026-1784856219, DEBIAN-CVE-2022-38648, GHSA-53jm-3hc9-fqqc, UBUNTU-CVE-2022-38648.