CVE-2022-42920 Apache Commons BCEL prior to 6.6.0 allows producing arbitrary bytecode via out-of-bounds writing
An out-of-bounds write in Apache Commons BCEL allows attackers to produce arbitrary bytecode, potentially leading to code execution in applications processing untrusted data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-42920?
CVE-2022-42920 is a critical memory corruption vulnerability in Fedoraproject Fedora, published on 7 Nov 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds writing issue, these APIs can be used to produce arbitrary bytecode. This could be abused in applications that pass attacker-controllable data to those APIs, giving the attacker more control over the resulting bytecode than otherwise expected. Update to Apache Commons BCEL 6.6.0.
Weakness: CWE-787
Which versions are affected by CVE-2022-42920?
2 open source packages ship an affected version, including org.apache.bcel:bcel. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.bcel:bcel Maven | All versions | 6.6.0 |
org.apache.bcel:bcel Maven | All versions | 6.6.0 |
Linux distribution packages (21)
bcel AlmaLinux:9 | All versions | 6.4.1-9.el9_1 |
bcel Red Hat:enterprise_linux:7::client | All versions | 0:5.2-19.el7_9 |
bcel-javadoc Red Hat:enterprise_linux:7::client | All versions | 0:5.2-19.el7_9 |
bcel Red Hat:enterprise_linux:7::computenode | All versions | 0:5.2-19.el7_9 |
bcel-javadoc Red Hat:enterprise_linux:7::computenode | All versions | 0:5.2-19.el7_9 |
bcel Red Hat:enterprise_linux:7::server | All versions | 0:5.2-19.el7_9 |
bcel-javadoc Red Hat:enterprise_linux:7::server | All versions | 0:5.2-19.el7_9 |
bcel Red Hat:enterprise_linux:7::workstation | All versions | 0:5.2-19.el7_9 |
bcel-javadoc Red Hat:enterprise_linux:7::workstation | All versions | 0:5.2-19.el7_9 |
bcel Red Hat:enterprise_linux:9::appstream | All versions | 0:6.4.1-9.el9_1 |
bcel Red Hat:rhel_eus:9.0::appstream | All versions | 0:6.4.1-9.el9_0 |
rh-maven36-bcel Red Hat:rhel_software_collections:3::el7 | All versions | 0:6.3.1-2.3.el7 |
rh-maven36-bcel-javadoc Red Hat:rhel_software_collections:3::el7 | All versions | 0:6.3.1-2.3.el7 |
bcel Rocky Linux:9 | All versions | 0:6.4.1-9.el9_1 |
bcel SUSE:Linux Enterprise Module for Basesystem 15 SP3 | All versions | 5.2-150200.11.3.1 |
bcel SUSE:Linux Enterprise Module for Basesystem 15 SP4 | All versions | 5.2-150200.11.3.1 |
bcel SUSE:Linux Enterprise Server 12 SP5 | All versions | 5.2-28.3.1 |
bcel SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 5.2-28.3.1 |
bcel openSUSE:Leap 15.3 | All versions | 5.2-150200.11.3.1 |
bcel openSUSE:Leap 15.4 | All versions | 5.2-150200.11.3.1 |
bcel openSUSE:Tumbleweed | All versions | 5.2-37.1 |
Products include Apache Commons Bcel, Fedoraproject Fedora.
How do I fix CVE-2022-42920?
Upgrade org.apache.bcel:bcel to 6.6.0 or later.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2022-42920 being exploited?
There is no known exploitation of CVE-2022-42920 in the wild and no public exploit code.
Sources
Also known as ALSA-2023:0005, AZL-109475, DEBIAN-CVE-2022-42920, GHSA-97xg-phpr-rg8q, RHSA-2022:8958, RHSA-2022:8959 and 9 more.