openSUSE has issued an advisory for this today (June 23):
https://lists.opensuse.org/opensuse-updates/2020-06/msg00093.html

batik-1.13-1.mga8 uploaded for Cauldron by David Geiger.

Fedora has issued an advisory for this on August 31:
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/N3V3MJVGDUNTVPXXGYR335PZJJK7LDXC/

Whiteboard: MGA7TOO => (none)
Version: Cauldron => 7
CC: (none) => geiger.david68210

*** Bug 28491 has been marked as a duplicate of this bug. ***

CC: (none) => mageia

this is fixed in mga7:

src:
    - batik-1.13-1.1.mga7

Assignee: java => qa-bugs

Apache has issued an advisory on February 24: https://www.openwall.com/lists/oss-security/2021/02/24/2

The issue is fixed upstream in 1.14: https://xmlgraphics.apache.org/security.html

Status comment: Fixed upstream in 1.13 => (none)

Saving advisory, but CVE-2020-11987 is not fixed.

Advisory:
========================

Updated batik packages fix security vulnerabilities:

A flaw was found in the Apache Batik library, where it is vulnerable to a
Server-Side Request Forgery attack (SSRF) via "xlink:href" attributes. This
flaw allows an attacker to cause the underlying server to make arbitrary GET
requests. The highest threat from this vulnerability is to system integrity
(CVE-2019-17566).

The Apache Batik library is vulnerable to SSRF via the NodePickerPanel that
allow an attacker to cause the underlying server to make arbitrary GET requests
(CVE-2020-11987).

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17566
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11987
https://www.openwall.com/lists/oss-security/2021/02/24/2
https://xmlgraphics.apache.org/security.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/N3V3MJVGDUNTVPXXGYR335PZJJK7LDXC/

Status comment: (none) => Fixed upstream in 1.14
Assignee: qa-bugs => java

Now patched in:
batik-1.13-1.1.mga7
batik-util-1.13-1.1.mga7
batik-css-1.13-1.1.mga7
batik-squiggle-1.13-1.1.mga7
batik-svgpp-1.13-1.1.mga7
batik-ttf2svg-1.13-1.1.mga7
batik-rasterizer-1.13-1.1.mga7
batik-slideshow-1.13-1.1.mga7
batik-javadoc-1.13-1.1.mga7
batik-demo-1.13-1.1.mga7

from batik-1.13-1.1.mga7.src.rpm

Assignee: java => qa-bugs
Status comment: Fixed upstream in 1.14 => (none)

Rebuilt to also fix Bug 28479.

batik-1.13-1.2.mga7
batik-util-1.13-1.2.mga7
batik-css-1.13-1.2.mga7
batik-squiggle-1.13-1.2.mga7
batik-svgpp-1.13-1.2.mga7
batik-ttf2svg-1.13-1.2.mga7
batik-rasterizer-1.13-1.2.mga7
batik-slideshow-1.13-1.2.mga7
batik-javadoc-1.13-1.2.mga7
batik-demo-1.13-1.2.mga7

from batik-1.13-1.2.mga7.src.rpm

Again rebuilt to also fix Bug 28479.


Packages in 7/core/updates_testing:
========================
batik-1.13-1.3.mga7
batik-css-1.13-1.3.mga7
batik-util-1.13-1.3.mga7
batik-svgpp-1.13-1.3.mga7
batik-slideshow-1.13-1.3.mga7
batik-rasterizer-1.13-1.3.mga7
batik-squiggle-1.13-1.3.mga7
batik-ttf2svg-1.13-1.3.mga7
batik-demo-1.13-1.3.mga7
batik-javadoc-1.13-1.3.mga7


Source RPM: 
========================
batik-1.13-1.3.mga7.src.rpm

MGA7-64

Not familiar.
Install well over existing packages (batik-1.13-1.3.mga7)

Not sure if need more tests.
Advisory committed.

CVE: (none) => CVE-2019-17566, CVE-2020-11987
CC: (none) => ouaurelien
Whiteboard: (none) => MGA7-64-OK

We validated in mga8 on a clean install, so it should be OK here, too.

Keywords: (none) => validated_update
CC: (none) => andrewsfarm, sysadmin-bugs

An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2021-0168.html

Resolution: (none) => FIXED
Status: NEW => RESOLVED