CVE Feed

    Dashboard / CVE / CVE-2022-34169

    CVE-2022-34169

    The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 or later. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.

    Published:Jul 19, 2022
    Last Modified:May 20, 2025
    EPS:Jul 19, 2022
    EPSS Score:0.10953
    CVSS Score:7.5

    Affected Products

    Vendor
    Apache
    Product
    Xalan-java
    Vendor
    Azul
    Product
    Zulu
    Vendor
    Debian
    Product
    Debian Linux
    Vendor
    Fedoraproject
    Product
    Fedora
    Vendor
    Netapp
    Product
    7-mode Transition Tool
    Vendor
    Netapp
    Product
    Active Iq Unified Manager
    Vendor
    Netapp
    Product
    Cloud Insights Acquisition Unit
    Vendor
    Netapp
    Product
    Cloud Secure Agent
    Vendor
    Netapp
    Product
    Hci Compute Node
    Vendor
    Netapp
    Product
    Hci Management Node
    Vendor
    Netapp
    Product
    Oncommand Insight
    Vendor
    Netapp
    Product
    Solidfire
    Vendor
    Oracle
    Product
    Graalvm
    Vendor
    Oracle
    Product
    Jdk
    Vendor
    Oracle
    Product
    Jre
    Vendor
    Oracle
    Product
    Openjdk
    Vendor
    Redhat
    Product
    Apache Camel Spring Boot
    Vendor
    Redhat
    Product
    Enterprise Linux
    Vendor
    Redhat
    Product
    Jboss Enterprise Application Platform
    Vendor
    Redhat
    Product
    Jboss Enterprise Application Platform Eus
    Vendor
    Redhat
    Product
    Openjdk
    Vendor
    Redhat
    Product
    Rhel E4s
    Vendor
    Redhat
    Product
    Rhel Eus

    Exploits

    https://github.com/bor8/CVE-2022-34169https://github.com/Disnaming/CVE-2022-34169https://github.com/flowerwind/AutoGenerateXalanPayload

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    References

    http://packetstormsecurity.com/files/168186/Xalan-J-XSLTC-Integer-Truncation.html
    http://www.openwall.com/lists/oss-security/2022/07/19/5
    http://www.openwall.com/lists/oss-security/2022/07/19/6
    http://www.openwall.com/lists/oss-security/2022/07/20/2
    http://www.openwall.com/lists/oss-security/2022/07/20/3
    http://www.openwall.com/lists/oss-security/2022/10/18/2
    http://www.openwall.com/lists/oss-security/2022/11/04/8
    http://www.openwall.com/lists/oss-security/2022/11/07/2
    https://lists.apache.org/thread/12pxy4phsry6c34x2ol4fft6xlho4kyw
    https://lists.apache.org/thread/2qvl7r43wb4t8p9dd9om1bnkssk07sn8
    https://lists.debian.org/debian-lts-announce/2022/10/msg00024.html
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H4YNJSJ64NPCNKFPNBYITNZU5H3L4D6L/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5OZNAZJ4YHLOKRRRZSWRT5OJ25E4XLM/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN3EVGR7FD3ZLV5SBTJXUIDCMSK4QUE2/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KO3DXNKZ4EU3UZBT6AAR4XRKCD73KLMO/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3XPOTPPBZIPFBZHQE5E7OW6PDACUMCJ/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YULPNO3PAWMEQQZV2C54I3H3ZOXFZUTB/
    https://security.gentoo.org/glsa/202401-25
    https://security.netapp.com/advisory/ntap-20220729-0009/
    https://security.netapp.com/advisory/ntap-20240621-0006/
    https://www.debian.org/security/2022/dsa-5188
    https://www.debian.org/security/2022/dsa-5192
    https://www.debian.org/security/2022/dsa-5256
    https://www.oracle.com/security-alerts/cpujul2022.html
    http://packetstormsecurity.com/files/168186/Xalan-J-XSLTC-Integer-Truncation.html
    http://www.openwall.com/lists/oss-security/2022/07/19/5
    http://www.openwall.com/lists/oss-security/2022/07/19/6
    http://www.openwall.com/lists/oss-security/2022/07/20/2
    http://www.openwall.com/lists/oss-security/2022/07/20/3
    http://www.openwall.com/lists/oss-security/2022/10/18/2
    http://www.openwall.com/lists/oss-security/2022/11/04/8
    http://www.openwall.com/lists/oss-security/2022/11/07/2
    https://lists.apache.org/thread/12pxy4phsry6c34x2ol4fft6xlho4kyw
    https://lists.apache.org/thread/2qvl7r43wb4t8p9dd9om1bnkssk07sn8
    https://lists.debian.org/debian-lts-announce/2022/10/msg00024.html
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H4YNJSJ64NPCNKFPNBYITNZU5H3L4D6L/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5OZNAZJ4YHLOKRRRZSWRT5OJ25E4XLM/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN3EVGR7FD3ZLV5SBTJXUIDCMSK4QUE2/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KO3DXNKZ4EU3UZBT6AAR4XRKCD73KLMO/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3XPOTPPBZIPFBZHQE5E7OW6PDACUMCJ/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YULPNO3PAWMEQQZV2C54I3H3ZOXFZUTB/
    https://security.gentoo.org/glsa/202401-25
    https://security.netapp.com/advisory/ntap-20220729-0009/
    https://security.netapp.com/advisory/ntap-20240621-0006/
    https://www.debian.org/security/2022/dsa-5188
    https://www.debian.org/security/2022/dsa-5192
    https://www.debian.org/security/2022/dsa-5256
    https://www.oracle.com/security-alerts/cpujul2022.html

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High