A security issue in the Apache Xalan Java XSLT library has been announced on July 19: https://www.openwall.com/lists/oss-security/2022/07/19/5 The fix is likely in the commit linked from this message: https://www.openwall.com/lists/oss-security/2022/07/20/3 which comes from a fix in the July 2022 Oracle CPU for Java: https://www.oracle.com/security-alerts/cpujul2022.html#AppendixJAVA Mageia 8 is also affected.
Whiteboard: (none) => MGA8TOOStatus comment: (none) => Patch available from OpenJDK
Assigning globally in the absence of a visible maintainer.
Assignee: bugsquad => pkg-bugs
Assignee: pkg-bugs => java
Apparently the true source of the bug is bcel: https://www.openwall.com/lists/oss-security/2022/10/18/2 An upstream commit to fix the issue is linked from the message above.
Summary: xalan-j2 new security issue CVE-2022-34169 => xalan-j2, bcel new security issue CVE-2022-34169Source RPM: xalan-j2-2.7.2-3.mga8.src.rpm => xalan-j2-2.7.2-3.mga8.src.rpm, bcel-6.4.1-2.mga8.src.rpm
(In reply to David Walser from comment #2) > Apparently the true source of the bug is bcel: > https://www.openwall.com/lists/oss-security/2022/10/18/2 > > An upstream commit to fix the issue is linked from the message above. Debian has issued an advisory for this on October 18: https://www.debian.org/security/2022/dsa-5256
Apache has issued an advisory for this on November 4: https://www.openwall.com/lists/oss-security/2022/11/04/6 It used a duplicate CVE, CVE-2022-42920: https://www.openwall.com/lists/oss-security/2022/11/04/8
openSUSE has issued an advisory for this on December 1: https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/NWWNNMR4ZBQI2A3G4VUI5NSF6HJXU7AP/
Fedora has issued an advisory for this on December 11: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/LX3HEB4TV2BVCGDTK5BCLSYOZNQTOBN4/
Fixed in our current bcel-6.5.0-2.mga9 package on cauldron!
Whiteboard: MGA8TOO => (none)CC: (none) => geiger.david68210Version: Cauldron => 8
Did the commit from Comment 0 ever get added to xalan-j2?
If I understand correctly this security issue only affect bcel which xalan-j2 depend on it: From debian: "Bug is most likely only in bcel which libxalan2-java depends on" https://github.com/advisories/GHSA-97xg-phpr-rg8q And commit from Comment 0 is to fix the bcel bundled copy into openjdk.
Mageia 8 EOL
CC: (none) => nicolas.salgueroStatus: NEW => RESOLVEDResolution: (none) => OLD