Apache Xalan security advisories
Security information for Apache Xalan
Reporting
Do you want disclose a potential security issue for Apache Xalan? Send your report to the Apache Security Team.
Advisories
This section is experimental: it provides advisories since 2023 and may lag behind the official CVE publications. If you have any feedback on how you would like this data to be provided, you are welcome to reach out on our public mailinglist or privately on security@apache.org
Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets
CVE-2022-34169 [CVE] [CVE json] [OSV json]
Last updated: 2022-07-21T12:21:22.370Z
Affected
- Apache Xalan-J from Xalan-J through 2.7.2
Description
The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode.
The Apache Xalan Java project is dormant and in the process of being retired. No future releases of Apache Xalan Java to address this issue are expected.
Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.
References
- https://lists.apache.org/thread/2qvl7r43wb4t8p9dd9om1bnkssk07sn8
- https://lists.apache.org/thread/12pxy4phsry6c34x2ol4fft6xlho4kyw
Credits
- Reported by Felix Wilhelm, Google Project Zero