CVE-2022-39135

    Dashboard / Vulnerabilities / CVE-2022-39135

    CVE-2022-39135

    Published: 11 Sept 2022Last Modified: 24 Oct 2026

    Summary: Apache Calcite: potential XEE attacks

    Details: Apache Calcite 1.22.0 introduced the SQL operators EXISTS_NODE, EXTRACT_XML, XML_TRANSFORM and EXTRACT_VALUE do not restrict XML External Entity references in their configuration, making them vulnerable to a potential XML External Entity (XXE) attack. Therefore any client exposing these operators, typically by using Oracle dialect (the first three) or MySQL dialect (the last one), is affected by this vulnerability (the extent of it will depend on the user under which the application is running). From Apache Calcite 1.32.0 onwards, Document Type Declarations and XML External Entity resolution are disabled on the impacted operators.

    References: https://lists.apache.org/thread/ohdnhlgm6jvt3srw8l7spkm2d5vwm082, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39135.json, https://nvd.nist.gov/vuln/detail/CVE-2022-39135, http://www.openwall.com/lists/oss-security/2022/11/21/3

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 537b8dbb4b58c61b6c573eb07a51b8d38896a1ff
    Fixed -413eded693a9087402cc1a6eefeca7a29445d337

    Affected versions

    calcite-1.31.0-rc3
    calcite-1.31.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-39135 | CVE-DB