CVE-2022-41704 Apache Batik prior to 1.16 allows RCE when loading untrusted SVG input
Attackers can execute arbitrary Java code by providing malicious SVG input to the Apache Batik library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-41704?
CVE-2022-41704 is a high-severity code injection vulnerability in Debian Debian Linux, published on 25 Oct 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability in Batik of Apache XML Graphics allows an attacker to run untrusted Java code from an SVG. This issue affects Apache XML Graphics prior to 1.16. It is recommended to update to version 1.16.
Weakness: CWE-918
Which versions are affected by CVE-2022-41704?
2 open source packages ship an affected version, including org.apache.xmlgraphics:batik. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.xmlgraphics:batik Maven | All versions | 1.16 |
org.apache.xmlgraphics:batik Maven | All versions | 1.16 |
Products include Apache Batik, Debian Debian Linux.
How do I fix CVE-2022-41704?
Upgrade org.apache.xmlgraphics:batik to 1.16 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2022-41704 being exploited?
There is no known exploitation of CVE-2022-41704 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
- CVE-2018-8013 Deserialization of Untrusted Data in Apache Batik
- CVE-2020-11987 Server-side request forgery (SSRF) in Apache Batik
- CVE-2022-42890 Apache Batik prior to 1.16 allows RCE via scripting
- CVE-2022-40146 Jar url should be blocked by DefaultScriptSecurity
- CVE-2019-17566 Server-side request forgery (SSRF) in Apache Batik
Sources
Also known as DEBIAN-CVE-2022-41704, GHSA-r29w-r9ph-vm76, UBUNTU-CVE-2022-41704.