Bug 1201684 (CVE-2022-34169)

Summary:	VUL-0: CVE-2022-34169: java,openjdk: integer truncation issue in Xalan
Product:	[Novell Products] SUSE Security Incidents	Reporter:	Gianluca Gabrielli <gianluca.gabrielli>
Component:	Incidents	Assignee:	Fridrich Strba <fstrba>
Status:	RESOLVED FIXED	QA Contact:	Security Team bot <security-team>
Severity:	Major
Priority:	P3 - Medium	CC:	cathy.hu, pmonrealgonzalez, security-team, stoyan.manolov, thomas.leroy
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/337663/
Whiteboard:	CVSSv3.1:SUSE:CVE-2022-34169:7.5:(AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description Gianluca Gabrielli 2022-07-20 09:17:47 UTC

An integer truncation issue was found in the Xalan Java XSLT library when processing malicious stylesheets. This flaw could be used to potentially execute arbitrary Java bytecode.

References:
https://bugzilla.redhat.com/show_bug.cgi?id=2108554
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-34169
http://www.openwall.com/lists/oss-security/2022/07/19/6
https://seclists.org/oss-sec/2022/q3/58
http://www.openwall.com/lists/oss-security/2022/07/19/5
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34169
https://lists.apache.org/thread/2qvl7r43wb4t8p9dd9om1bnkssk07sn8
https://lists.apache.org/thread/12pxy4phsry6c34x2ol4fft6xlho4kyw

Comment 1 Gianluca Gabrielli 2022-07-20 09:22:20 UTC

Affected packages:
 - SUSE:SLE-15:Update/java-10-openjdk           10.0.2.0
 - SUSE:SLE-12-SP5:Update/java-11-openjdk       11.0.15.}0~10
 - SUSE:SLE-15:Update/java-11-openjdk           11.0.15.}0~10
 - SUSE:SLE-15-SP4:Update/java-17-openjdk       17.0.3.}0~7
 - SUSE:SLE-11-SP2:Update/java-1_7_0-ibm        1.7.0_sr11.5
 - SUSE:SLE-12:Update/java-1_7_0-openjdk        1.7.0.321
 - SUSE:SLE-12:Update/java-1_7_1-ibm            1.7.1_sr5.5
 - SUSE:SLE-12-SP1:Update/java-1_8_0-ibm        1.8.0_sr7.5
 - SUSE:SLE-15:Update/java-1_8_0-ibm            1.8.0_sr7.5
 - SUSE:SLE-12-SP1:Update/java-1_8_0-openjdk    1.8.0.322
 - SUSE:SLE-15:Update/java-1_8_0-openjdk        1.8.0.322
 - openSUSE:Factory/java-11-openjdk             11.0.15.}0~10
 - openSUSE:Factory/java-17-openjdk             17.0.3.}0~7
 - openSUSE:Factory/java-1_8_0-openjdk          1.8.0.332

Upstream patch:
 - https://github.com/openjdk/jdk/commit/41ef2b249073450172e11163a4d05762364b1297

Upstream bug:
 - https://bugs.openjdk.org/browse/JDK-8285407 (currently private)

Comment 4 Swamp Workflow Management 2022-08-01 13:47:24 UTC

SUSE-SU-2022:2610-1: An update that fixes three vulnerabilities is now available.

Category: security (important)
Bug References: 1201684,1201692,1201694
CVE References: CVE-2022-21540,CVE-2022-21541,CVE-2022-34169
JIRA References: 
Sources used:
SUSE Linux Enterprise Server 12-SP5 (src):    java-11-openjdk-11.0.16.0-3.46.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 6 Swamp Workflow Management 2022-08-03 22:19:11 UTC

SUSE-SU-2022:2660-1: An update that fixes four vulnerabilities is now available.

Category: security (important)
Bug References: 1201684,1201685,1201692,1201694
CVE References: CVE-2022-21540,CVE-2022-21541,CVE-2022-21549,CVE-2022-34169
JIRA References: 
Sources used:
openSUSE Leap 15.4 (src):    java-17-openjdk-17.0.4.0-150400.3.3.1
SUSE Linux Enterprise Module for Basesystem 15-SP4 (src):    java-17-openjdk-17.0.4.0-150400.3.3.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 7 Swamp Workflow Management 2022-08-09 13:17:18 UTC

SUSE-SU-2022:2707-1: An update that fixes three vulnerabilities is now available.

Category: security (important)
Bug References: 1201684,1201692,1201694
CVE References: CVE-2022-21540,CVE-2022-21541,CVE-2022-34169
JIRA References: 
Sources used:
openSUSE Leap 15.4 (src):    java-11-openjdk-11.0.16.0-150000.3.83.1
openSUSE Leap 15.3 (src):    java-11-openjdk-11.0.16.0-150000.3.83.1
SUSE Manager Server 4.1 (src):    java-11-openjdk-11.0.16.0-150000.3.83.1
SUSE Manager Retail Branch Server 4.1 (src):    java-11-openjdk-11.0.16.0-150000.3.83.1
SUSE Manager Proxy 4.1 (src):    java-11-openjdk-11.0.16.0-150000.3.83.1
SUSE Linux Enterprise Server for SAP 15-SP2 (src):    java-11-openjdk-11.0.16.0-150000.3.83.1
SUSE Linux Enterprise Server for SAP 15-SP1 (src):    java-11-openjdk-11.0.16.0-150000.3.83.1
SUSE Linux Enterprise Server for SAP 15 (src):    java-11-openjdk-11.0.16.0-150000.3.83.1
SUSE Linux Enterprise Server 15-SP2-LTSS (src):    java-11-openjdk-11.0.16.0-150000.3.83.1
SUSE Linux Enterprise Server 15-SP2-BCL (src):    java-11-openjdk-11.0.16.0-150000.3.83.1
SUSE Linux Enterprise Server 15-SP1-LTSS (src):    java-11-openjdk-11.0.16.0-150000.3.83.1
SUSE Linux Enterprise Server 15-SP1-BCL (src):    java-11-openjdk-11.0.16.0-150000.3.83.1
SUSE Linux Enterprise Server 15-LTSS (src):    java-11-openjdk-11.0.16.0-150000.3.83.1
SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP4 (src):    java-11-openjdk-11.0.16.0-150000.3.83.1
SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3 (src):    java-11-openjdk-11.0.16.0-150000.3.83.1
SUSE Linux Enterprise Module for Basesystem 15-SP4 (src):    java-11-openjdk-11.0.16.0-150000.3.83.1
SUSE Linux Enterprise Module for Basesystem 15-SP3 (src):    java-11-openjdk-11.0.16.0-150000.3.83.1
SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (src):    java-11-openjdk-11.0.16.0-150000.3.83.1
SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (src):    java-11-openjdk-11.0.16.0-150000.3.83.1
SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src):    java-11-openjdk-11.0.16.0-150000.3.83.1
SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (src):    java-11-openjdk-11.0.16.0-150000.3.83.1
SUSE Linux Enterprise High Performance Computing 15-LTSS (src):    java-11-openjdk-11.0.16.0-150000.3.83.1
SUSE Linux Enterprise High Performance Computing 15-ESPOS (src):    java-11-openjdk-11.0.16.0-150000.3.83.1
SUSE Enterprise Storage 7 (src):    java-11-openjdk-11.0.16.0-150000.3.83.1
SUSE Enterprise Storage 6 (src):    java-11-openjdk-11.0.16.0-150000.3.83.1
SUSE CaaS Platform 4.0 (src):    java-11-openjdk-11.0.16.0-150000.3.83.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 12 Swamp Workflow Management 2022-08-16 16:19:59 UTC

SUSE-SU-2022:2819-1: An update that solves three vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1195163,1201684,1201692,1201694
CVE References: CVE-2022-21540,CVE-2022-21541,CVE-2022-34169
JIRA References: 
Sources used:
SUSE OpenStack Cloud Crowbar 9 (src):    java-1_8_0-openjdk-1.8.0.345-27.78.1
SUSE OpenStack Cloud 9 (src):    java-1_8_0-openjdk-1.8.0.345-27.78.1
SUSE Linux Enterprise Server for SAP 12-SP4 (src):    java-1_8_0-openjdk-1.8.0.345-27.78.1
SUSE Linux Enterprise Server 12-SP5 (src):    java-1_8_0-openjdk-1.8.0.345-27.78.1
SUSE Linux Enterprise Server 12-SP4-LTSS (src):    java-1_8_0-openjdk-1.8.0.345-27.78.1
SUSE Linux Enterprise Server 12-SP3-BCL (src):    java-1_8_0-openjdk-1.8.0.345-27.78.1
SUSE Linux Enterprise Server 12-SP2-BCL (src):    java-1_8_0-openjdk-1.8.0.345-27.78.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 14 Swamp Workflow Management 2022-08-19 19:20:01 UTC

SUSE-SU-2022:2856-1: An update that solves three vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1195163,1201684,1201692,1201694
CVE References: CVE-2022-21540,CVE-2022-21541,CVE-2022-34169
JIRA References: 
Sources used:
openSUSE Leap 15.4 (src):    java-1_8_0-openjdk-1.8.0.345-150000.3.70.1
openSUSE Leap 15.3 (src):    java-1_8_0-openjdk-1.8.0.345-150000.3.70.1
SUSE Manager Server 4.1 (src):    java-1_8_0-openjdk-1.8.0.345-150000.3.70.1
SUSE Manager Retail Branch Server 4.1 (src):    java-1_8_0-openjdk-1.8.0.345-150000.3.70.1
SUSE Manager Proxy 4.1 (src):    java-1_8_0-openjdk-1.8.0.345-150000.3.70.1
SUSE Linux Enterprise Server for SAP 15-SP2 (src):    java-1_8_0-openjdk-1.8.0.345-150000.3.70.1
SUSE Linux Enterprise Server for SAP 15-SP1 (src):    java-1_8_0-openjdk-1.8.0.345-150000.3.70.1
SUSE Linux Enterprise Server for SAP 15 (src):    java-1_8_0-openjdk-1.8.0.345-150000.3.70.1
SUSE Linux Enterprise Server 15-SP2-LTSS (src):    java-1_8_0-openjdk-1.8.0.345-150000.3.70.1
SUSE Linux Enterprise Server 15-SP1-LTSS (src):    java-1_8_0-openjdk-1.8.0.345-150000.3.70.1
SUSE Linux Enterprise Server 15-SP1-BCL (src):    java-1_8_0-openjdk-1.8.0.345-150000.3.70.1
SUSE Linux Enterprise Server 15-LTSS (src):    java-1_8_0-openjdk-1.8.0.345-150000.3.70.1
SUSE Linux Enterprise Module for Legacy Software 15-SP4 (src):    java-1_8_0-openjdk-1.8.0.345-150000.3.70.1
SUSE Linux Enterprise Module for Legacy Software 15-SP3 (src):    java-1_8_0-openjdk-1.8.0.345-150000.3.70.1
SUSE Enterprise Storage 7 (src):    java-1_8_0-openjdk-1.8.0.345-150000.3.70.1
SUSE Enterprise Storage 6 (src):    java-1_8_0-openjdk-1.8.0.345-150000.3.70.1
SUSE CaaS Platform 4.0 (src):    java-1_8_0-openjdk-1.8.0.345-150000.3.70.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 15 Swamp Workflow Management 2022-08-25 22:16:52 UTC

SUSE-SU-2022:2899-1: An update that solves four vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1201684,1201685,1201692,1201694,1202427
CVE References: CVE-2022-21540,CVE-2022-21541,CVE-2022-21549,CVE-2022-34169
JIRA References: 
Sources used:
SUSE OpenStack Cloud Crowbar 9 (src):    java-1_8_0-ibm-1.8.0_sr7.11-30.93.1
SUSE OpenStack Cloud 9 (src):    java-1_8_0-ibm-1.8.0_sr7.11-30.93.1
SUSE Linux Enterprise Software Development Kit 12-SP5 (src):    java-1_8_0-ibm-1.8.0_sr7.11-30.93.1
SUSE Linux Enterprise Server for SAP 12-SP4 (src):    java-1_8_0-ibm-1.8.0_sr7.11-30.93.1
SUSE Linux Enterprise Server 12-SP5 (src):    java-1_8_0-ibm-1.8.0_sr7.11-30.93.1
SUSE Linux Enterprise Server 12-SP4-LTSS (src):    java-1_8_0-ibm-1.8.0_sr7.11-30.93.1
SUSE Linux Enterprise Server 12-SP3-BCL (src):    java-1_8_0-ibm-1.8.0_sr7.11-30.93.1
SUSE Linux Enterprise Server 12-SP2-BCL (src):    java-1_8_0-ibm-1.8.0_sr7.11-30.93.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 16 Swamp Workflow Management 2022-08-25 22:17:56 UTC

SUSE-SU-2022:2898-1: An update that solves four vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1201684,1201685,1201692,1201694,1202427
CVE References: CVE-2022-21540,CVE-2022-21541,CVE-2022-21549,CVE-2022-34169
JIRA References: 
Sources used:
SUSE OpenStack Cloud Crowbar 9 (src):    java-1_7_1-ibm-1.7.1_sr5.15-38.74.1
SUSE OpenStack Cloud 9 (src):    java-1_7_1-ibm-1.7.1_sr5.15-38.74.1
SUSE Linux Enterprise Software Development Kit 12-SP5 (src):    java-1_7_1-ibm-1.7.1_sr5.15-38.74.1
SUSE Linux Enterprise Server for SAP 12-SP4 (src):    java-1_7_1-ibm-1.7.1_sr5.15-38.74.1
SUSE Linux Enterprise Server 12-SP5 (src):    java-1_7_1-ibm-1.7.1_sr5.15-38.74.1
SUSE Linux Enterprise Server 12-SP4-LTSS (src):    java-1_7_1-ibm-1.7.1_sr5.15-38.74.1
SUSE Linux Enterprise Server 12-SP3-BCL (src):    java-1_7_1-ibm-1.7.1_sr5.15-38.74.1
SUSE Linux Enterprise Server 12-SP2-BCL (src):    java-1_7_1-ibm-1.7.1_sr5.15-38.74.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 18 Swamp Workflow Management 2022-08-31 13:17:42 UTC

SUSE-SU-2022:2949-1: An update that solves four vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1201684,1201685,1201692,1201694,1202427
CVE References: CVE-2022-21540,CVE-2022-21541,CVE-2022-21549,CVE-2022-34169
JIRA References: 
Sources used:
openSUSE Leap 15.4 (src):    java-1_8_0-ibm-1.8.0_sr7.11-150000.3.62.1
openSUSE Leap 15.3 (src):    java-1_8_0-ibm-1.8.0_sr7.11-150000.3.62.1
SUSE Manager Server 4.1 (src):    java-1_8_0-ibm-1.8.0_sr7.11-150000.3.62.1
SUSE Manager Retail Branch Server 4.1 (src):    java-1_8_0-ibm-1.8.0_sr7.11-150000.3.62.1
SUSE Manager Proxy 4.1 (src):    java-1_8_0-ibm-1.8.0_sr7.11-150000.3.62.1
SUSE Linux Enterprise Server for SAP 15-SP2 (src):    java-1_8_0-ibm-1.8.0_sr7.11-150000.3.62.1
SUSE Linux Enterprise Server for SAP 15-SP1 (src):    java-1_8_0-ibm-1.8.0_sr7.11-150000.3.62.1
SUSE Linux Enterprise Server for SAP 15 (src):    java-1_8_0-ibm-1.8.0_sr7.11-150000.3.62.1
SUSE Linux Enterprise Server 15-SP2-LTSS (src):    java-1_8_0-ibm-1.8.0_sr7.11-150000.3.62.1
SUSE Linux Enterprise Server 15-SP1-LTSS (src):    java-1_8_0-ibm-1.8.0_sr7.11-150000.3.62.1
SUSE Linux Enterprise Server 15-SP1-BCL (src):    java-1_8_0-ibm-1.8.0_sr7.11-150000.3.62.1
SUSE Linux Enterprise Server 15-LTSS (src):    java-1_8_0-ibm-1.8.0_sr7.11-150000.3.62.1
SUSE Linux Enterprise Module for Legacy Software 15-SP4 (src):    java-1_8_0-ibm-1.8.0_sr7.11-150000.3.62.1
SUSE Linux Enterprise Module for Legacy Software 15-SP3 (src):    java-1_8_0-ibm-1.8.0_sr7.11-150000.3.62.1
SUSE Enterprise Storage 7 (src):    java-1_8_0-ibm-1.8.0_sr7.11-150000.3.62.1
SUSE Enterprise Storage 6 (src):    java-1_8_0-ibm-1.8.0_sr7.11-150000.3.62.1
SUSE CaaS Platform 4.0 (src):    java-1_8_0-ibm-1.8.0_sr7.11-150000.3.62.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 20 Swamp Workflow Management 2022-09-06 10:28:23 UTC

SUSE-SU-2022:3092-1: An update that fixes 9 vulnerabilities is now available.

Category: security (important)
Bug References: 1198671,1198672,1198673,1198674,1198675,1198935,1201684,1201692,1201694
CVE References: CVE-2021-41041,CVE-2022-21426,CVE-2022-21434,CVE-2022-21443,CVE-2022-21476,CVE-2022-21496,CVE-2022-21540,CVE-2022-21541,CVE-2022-34169
JIRA References: 
Sources used:
openSUSE Leap 15.4 (src):    java-1_8_0-openj9-1.8.0.345-150200.3.24.1
openSUSE Leap 15.3 (src):    java-1_8_0-openj9-1.8.0.345-150200.3.24.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 22 Swamp Workflow Management 2022-09-07 16:27:18 UTC

SUSE-SU-2022:3152-1: An update that solves four vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1201684,1201685,1201692,1201694,1202427
CVE References: CVE-2022-21540,CVE-2022-21541,CVE-2022-21549,CVE-2022-34169
JIRA References: 
Sources used:
SUSE OpenStack Cloud Crowbar 9 (src):    java-1_8_0-ibm-1.8.0_sr7.15-30.96.1
SUSE OpenStack Cloud 9 (src):    java-1_8_0-ibm-1.8.0_sr7.15-30.96.1
SUSE Linux Enterprise Software Development Kit 12-SP5 (src):    java-1_8_0-ibm-1.8.0_sr7.15-30.96.1
SUSE Linux Enterprise Server for SAP 12-SP4 (src):    java-1_8_0-ibm-1.8.0_sr7.15-30.96.1
SUSE Linux Enterprise Server 12-SP5 (src):    java-1_8_0-ibm-1.8.0_sr7.15-30.96.1
SUSE Linux Enterprise Server 12-SP4-LTSS (src):    java-1_8_0-ibm-1.8.0_sr7.15-30.96.1
SUSE Linux Enterprise Server 12-SP3-BCL (src):    java-1_8_0-ibm-1.8.0_sr7.15-30.96.1
SUSE Linux Enterprise Server 12-SP2-BCL (src):    java-1_8_0-ibm-1.8.0_sr7.15-30.96.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 27 Swamp Workflow Management 2022-11-22 14:26:26 UTC

SUSE-SU-2022:4166-1: An update that solves 10 vulnerabilities and has two fixes is now available.

Category: security (important)
Bug References: 1201684,1201685,1201692,1201694,1202427,1204468,1204471,1204472,1204473,1204475,1204480,1205302
CVE References: CVE-2022-21540,CVE-2022-21541,CVE-2022-21549,CVE-2022-21618,CVE-2022-21619,CVE-2022-21624,CVE-2022-21626,CVE-2022-21628,CVE-2022-34169,CVE-2022-39399
JIRA References: 
Sources used:
openSUSE Leap 15.4 (src):    java-1_8_0-ibm-1.8.0_sr7.20-150000.3.65.1
openSUSE Leap 15.3 (src):    java-1_8_0-ibm-1.8.0_sr7.20-150000.3.65.1
SUSE Manager Server 4.1 (src):    java-1_8_0-ibm-1.8.0_sr7.20-150000.3.65.1
SUSE Manager Retail Branch Server 4.1 (src):    java-1_8_0-ibm-1.8.0_sr7.20-150000.3.65.1
SUSE Manager Proxy 4.1 (src):    java-1_8_0-ibm-1.8.0_sr7.20-150000.3.65.1
SUSE Linux Enterprise Server for SAP 15-SP2 (src):    java-1_8_0-ibm-1.8.0_sr7.20-150000.3.65.1
SUSE Linux Enterprise Server for SAP 15-SP1 (src):    java-1_8_0-ibm-1.8.0_sr7.20-150000.3.65.1
SUSE Linux Enterprise Server for SAP 15 (src):    java-1_8_0-ibm-1.8.0_sr7.20-150000.3.65.1
SUSE Linux Enterprise Server 15-SP2-LTSS (src):    java-1_8_0-ibm-1.8.0_sr7.20-150000.3.65.1
SUSE Linux Enterprise Server 15-SP1-LTSS (src):    java-1_8_0-ibm-1.8.0_sr7.20-150000.3.65.1
SUSE Linux Enterprise Server 15-SP1-BCL (src):    java-1_8_0-ibm-1.8.0_sr7.20-150000.3.65.1
SUSE Linux Enterprise Server 15-LTSS (src):    java-1_8_0-ibm-1.8.0_sr7.20-150000.3.65.1
SUSE Linux Enterprise Module for Legacy Software 15-SP4 (src):    java-1_8_0-ibm-1.8.0_sr7.20-150000.3.65.1
SUSE Linux Enterprise Module for Legacy Software 15-SP3 (src):    java-1_8_0-ibm-1.8.0_sr7.20-150000.3.65.1
SUSE Enterprise Storage 7 (src):    java-1_8_0-ibm-1.8.0_sr7.20-150000.3.65.1
SUSE Enterprise Storage 6 (src):    java-1_8_0-ibm-1.8.0_sr7.20-150000.3.65.1
SUSE CaaS Platform 4.0 (src):    java-1_8_0-ibm-1.8.0_sr7.20-150000.3.65.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.