CVE-2022-42890 Apache Batik prior to 1.16 allows RCE via scripting

What is CVE-2022-42890?

CVE-2022-42890 is a high-severity code injection vulnerability in Debian Debian Linux, published on 25 Oct 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability in Batik of Apache XML Graphics allows an attacker to run Java code from untrusted SVG via JavaScript. This issue affects Apache XML Graphics prior to 1.16. Users are recommended to upgrade to version 1.16.

Weakness: CWE-918

Which versions are affected by CVE-2022-42890?

4 open source packages ship an affected version, including org.apache.xmlgraphics:batik and org.apache.xmlgraphics:batik-bridge. It affects 2 products.

Products include Apache Batik, Debian Debian Linux.

How do I fix CVE-2022-42890?

Upgrade org.apache.xmlgraphics:batik to 1.16 or later.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2022-42890 being exploited?

There is no known exploitation of CVE-2022-42890 in the wild and no public exploit code.

Other vulnerabilities in Debian Debian Linux

• CVE-2018-8013 Deserialization of Untrusted Data in Apache Batik Critical 9.8
• CVE-2020-11987 Server-side request forgery (SSRF) in Apache Batik High 8.2
• CVE-2022-41704 Apache Batik prior to 1.16 allows RCE when loading untrusted SVG input High 7.5
• CVE-2022-40146 Jar url should be blocked by DefaultScriptSecurity High 7.5
• CVE-2019-17566 Server-side request forgery (SSRF) in Apache Batik High 7.5

All Debian Debian Linux vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2022-42890, GHSA-rwqr-m72q-v6cm, UBUNTU-CVE-2022-42890.