CVE-2022-42920
Summary
| CVE | CVE-2022-42920 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2022-11-07 13:15:00 UTC |
| Updated | 2024-01-17 15:15:00 UTC |
| Description | Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds writing issue, these APIs can be used to produce arbitrary bytecode. This could be abused in applications that pass attacker-controllable data to those APIs, giving the attacker more control over the resulting bytecode than otherwise expected. Update to Apache Commons BCEL 6.6.0. |
Risk And Classification
Problem Types: CWE-787
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Apache | Commons Bcel | All | All | All | All |
| Operating System | Fedoraproject | Fedora | 35 | All | All | All |
| Operating System | Fedoraproject | Fedora | 36 | All | All | All |
| Operating System | Fedoraproject | Fedora | 37 | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| [SECURITY] Fedora 37 Update: bcel-6.5.0-3.fc37 - package-announce - Fedora Mailing-Lists | FEDORA | lists.fedoraproject.org | |
| [SECURITY] Fedora 35 Update: bcel-6.4.1-10.fc35 - package-announce - Fedora Mailing-Lists | lists.fedoraproject.org | ||
| [SECURITY] Fedora 36 Update: bcel-6.4.1-10.fc36 - package-announce - Fedora Mailing-Lists | FEDORA | lists.fedoraproject.org | |
| OpenJDK: Multiple Vulnerabilities (GLSA 202401-25) — Gentoo security | security.gentoo.org | ||
| lists.apache.org/thread/lfxk7q8qmnh5bt9jm6nmjlv5hsxjhrz4 | MISC | lists.apache.org | |
| [SECURITY] Fedora 35 Update: bcel-6.4.1-10.fc35 - package-announce - Fedora Mailing-Lists | FEDORA | lists.fedoraproject.org | |
| oss-security - Re: CVE-2022-42920: Apache Commons BCEL prior to 6.6.0 allows producing arbitrary bytecode via out-of-bounds writing | MLIST | www.openwall.com | |
| [SECURITY] Fedora 36 Update: bcel-6.4.1-10.fc36 - package-announce - Fedora Mailing-Lists | lists.fedoraproject.org | ||
| [SECURITY] Fedora 37 Update: bcel-6.5.0-3.fc37 - package-announce - Fedora Mailing-Lists | lists.fedoraproject.org | ||
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
LEGACY: Reported by Felix Wilhelm (Google); GitHub pull request to Apache Commons BCEL #147 by Richard Atkins (https://github.com/rjatkins); PR derived from OpenJDK (https://github.com/openjdk/jdk11u/) commit 13bf52c8d876528a43be7cb77a1f452d29a21492 by Aleksei Voitylov and RealCLanger (Christoph Langer https://github.com/RealCLanger)
Legacy QID Mappings
- 150735 Oracle WebLogic Server Multiple Vulnerabilities (CPU - OCT2023)
- 160356 Oracle Enterprise Linux Security Update for bcel (ELSA-2022-8958)
- 160366 Oracle Enterprise Linux Security Update for bcel (ELSA-2023-0005)
- 181194 Debian Security Update for bcel (CVE-2022-42920)
- 241005 Red Hat Update for rh-maven36-bcel (RHSA-2022:8959)
- 241010 Red Hat Update for bcel (RHSA-2022:8958)
- 241031 Red Hat Update for bcel (RHSA-2023:0004)
- 241032 Red Hat Update for bcel (RHSA-2023:0005)
- 257240 CentOS Security Update for bcel (CESA-2022:8958)
- 283507 Fedora Security Update for bcel (FEDORA-2022-01a56f581c)
- 283508 Fedora Security Update for bcel (FEDORA-2022-0e358addb8)
- 283509 Fedora Security Update for bcel (FEDORA-2022-f60a52e054)
- 354663 Amazon Linux Security Advisory for bcel : ALAS2-2023-1916
- 354674 Amazon Linux Security Advisory for bcel : ALAS-2023-1668
- 354702 Amazon Linux Security Advisory for bcel : ALAS2022-2023-275
- 355196 Amazon Linux Security Advisory for bcel : ALAS2023-2023-105
- 672579 EulerOS Security Update for bcel (EulerOS-SA-2023-1307)
- 673088 EulerOS Security Update for bcel (EulerOS-SA-2023-2137)
- 710843 Gentoo Linux Open Java Development Toolkit (OpenJDK) Multiple Vulnerabilities (GLSA 202401-25)
- 752973 SUSE Enterprise Linux Security Update for bcel (SUSE-SU-2022:4331-1)
- 752977 SUSE Enterprise Linux Security Update for bcel (SUSE-SU-2022:4306-1)
- 87530 Oracle WebLogic Server Multiple Vulnerabilities (CPUJAN2023)
- 87548 Oracle WebLogic Server Multiple Vulnerabilities (CPUOCT2023)
- 940864 AlmaLinux Security Update for bcel (ALSA-2023:0005)
- 960494 Rocky Linux Security Update for bcel (RLSA-2023:0005)