Bug 1201684 - (CVE-2022-34169) VUL-0: CVE-2022-34169: java,openjdk: integer truncation issue in Xalan
(CVE-2022-34169)
VUL-0: CVE-2022-34169: java,openjdk: integer truncation issue in Xalan
Status: NEW
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Major
: ---
Assigned To: Fridrich Strba
Security Team bot
https://smash.suse.de/issue/337663/
CVSSv3.1:SUSE:CVE-2022-34169:7.5:(AV:...
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2022-07-20 09:17 UTC by Gianluca Gabrielli
Modified: 2022-09-20 09:06 UTC (History)
4 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Comment 1 Gianluca Gabrielli 2022-07-20 09:22:20 UTC
Affected packages:
 - SUSE:SLE-15:Update/java-10-openjdk           10.0.2.0
 - SUSE:SLE-12-SP5:Update/java-11-openjdk       11.0.15.}0~10
 - SUSE:SLE-15:Update/java-11-openjdk           11.0.15.}0~10
 - SUSE:SLE-15-SP4:Update/java-17-openjdk       17.0.3.}0~7
 - SUSE:SLE-11-SP2:Update/java-1_7_0-ibm        1.7.0_sr11.5
 - SUSE:SLE-12:Update/java-1_7_0-openjdk        1.7.0.321
 - SUSE:SLE-12:Update/java-1_7_1-ibm            1.7.1_sr5.5
 - SUSE:SLE-12-SP1:Update/java-1_8_0-ibm        1.8.0_sr7.5
 - SUSE:SLE-15:Update/java-1_8_0-ibm            1.8.0_sr7.5
 - SUSE:SLE-12-SP1:Update/java-1_8_0-openjdk    1.8.0.322
 - SUSE:SLE-15:Update/java-1_8_0-openjdk        1.8.0.322
 - openSUSE:Factory/java-11-openjdk             11.0.15.}0~10
 - openSUSE:Factory/java-17-openjdk             17.0.3.}0~7
 - openSUSE:Factory/java-1_8_0-openjdk          1.8.0.332

Upstream patch:
 - https://github.com/openjdk/jdk/commit/41ef2b249073450172e11163a4d05762364b1297

Upstream bug:
 - https://bugs.openjdk.org/browse/JDK-8285407 (currently private)
Comment 4 Swamp Workflow Management 2022-08-01 13:47:24 UTC
SUSE-SU-2022:2610-1: An update that fixes three vulnerabilities is now available.

Category: security (important)
Bug References: 1201684,1201692,1201694
CVE References: CVE-2022-21540,CVE-2022-21541,CVE-2022-34169
JIRA References: 
Sources used:
SUSE Linux Enterprise Server 12-SP5 (src):    java-11-openjdk-11.0.16.0-3.46.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 6 Swamp Workflow Management 2022-08-03 22:19:11 UTC
SUSE-SU-2022:2660-1: An update that fixes four vulnerabilities is now available.

Category: security (important)
Bug References: 1201684,1201685,1201692,1201694
CVE References: CVE-2022-21540,CVE-2022-21541,CVE-2022-21549,CVE-2022-34169
JIRA References: 
Sources used:
openSUSE Leap 15.4 (src):    java-17-openjdk-17.0.4.0-150400.3.3.1
SUSE Linux Enterprise Module for Basesystem 15-SP4 (src):    java-17-openjdk-17.0.4.0-150400.3.3.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 7 Swamp Workflow Management 2022-08-09 13:17:18 UTC
SUSE-SU-2022:2707-1: An update that fixes three vulnerabilities is now available.

Category: security (important)
Bug References: 1201684,1201692,1201694
CVE References: CVE-2022-21540,CVE-2022-21541,CVE-2022-34169
JIRA References: 
Sources used:
openSUSE Leap 15.4 (src):    java-11-openjdk-11.0.16.0-150000.3.83.1
openSUSE Leap 15.3 (src):    java-11-openjdk-11.0.16.0-150000.3.83.1
SUSE Manager Server 4.1 (src):    java-11-openjdk-11.0.16.0-150000.3.83.1
SUSE Manager Retail Branch Server 4.1 (src):    java-11-openjdk-11.0.16.0-150000.3.83.1
SUSE Manager Proxy 4.1 (src):    java-11-openjdk-11.0.16.0-150000.3.83.1
SUSE Linux Enterprise Server for SAP 15-SP2 (src):    java-11-openjdk-11.0.16.0-150000.3.83.1
SUSE Linux Enterprise Server for SAP 15-SP1 (src):    java-11-openjdk-11.0.16.0-150000.3.83.1
SUSE Linux Enterprise Server for SAP 15 (src):    java-11-openjdk-11.0.16.0-150000.3.83.1
SUSE Linux Enterprise Server 15-SP2-LTSS (src):    java-11-openjdk-11.0.16.0-150000.3.83.1
SUSE Linux Enterprise Server 15-SP2-BCL (src):    java-11-openjdk-11.0.16.0-150000.3.83.1
SUSE Linux Enterprise Server 15-SP1-LTSS (src):    java-11-openjdk-11.0.16.0-150000.3.83.1
SUSE Linux Enterprise Server 15-SP1-BCL (src):    java-11-openjdk-11.0.16.0-150000.3.83.1
SUSE Linux Enterprise Server 15-LTSS (src):    java-11-openjdk-11.0.16.0-150000.3.83.1
SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP4 (src):    java-11-openjdk-11.0.16.0-150000.3.83.1
SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3 (src):    java-11-openjdk-11.0.16.0-150000.3.83.1
SUSE Linux Enterprise Module for Basesystem 15-SP4 (src):    java-11-openjdk-11.0.16.0-150000.3.83.1
SUSE Linux Enterprise Module for Basesystem 15-SP3 (src):    java-11-openjdk-11.0.16.0-150000.3.83.1
SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (src):    java-11-openjdk-11.0.16.0-150000.3.83.1
SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (src):    java-11-openjdk-11.0.16.0-150000.3.83.1
SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src):    java-11-openjdk-11.0.16.0-150000.3.83.1
SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (src):    java-11-openjdk-11.0.16.0-150000.3.83.1
SUSE Linux Enterprise High Performance Computing 15-LTSS (src):    java-11-openjdk-11.0.16.0-150000.3.83.1
SUSE Linux Enterprise High Performance Computing 15-ESPOS (src):    java-11-openjdk-11.0.16.0-150000.3.83.1
SUSE Enterprise Storage 7 (src):    java-11-openjdk-11.0.16.0-150000.3.83.1
SUSE Enterprise Storage 6 (src):    java-11-openjdk-11.0.16.0-150000.3.83.1
SUSE CaaS Platform 4.0 (src):    java-11-openjdk-11.0.16.0-150000.3.83.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 12 Swamp Workflow Management 2022-08-16 16:19:59 UTC
SUSE-SU-2022:2819-1: An update that solves three vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1195163,1201684,1201692,1201694
CVE References: CVE-2022-21540,CVE-2022-21541,CVE-2022-34169
JIRA References: 
Sources used:
SUSE OpenStack Cloud Crowbar 9 (src):    java-1_8_0-openjdk-1.8.0.345-27.78.1
SUSE OpenStack Cloud 9 (src):    java-1_8_0-openjdk-1.8.0.345-27.78.1
SUSE Linux Enterprise Server for SAP 12-SP4 (src):    java-1_8_0-openjdk-1.8.0.345-27.78.1
SUSE Linux Enterprise Server 12-SP5 (src):    java-1_8_0-openjdk-1.8.0.345-27.78.1
SUSE Linux Enterprise Server 12-SP4-LTSS (src):    java-1_8_0-openjdk-1.8.0.345-27.78.1
SUSE Linux Enterprise Server 12-SP3-BCL (src):    java-1_8_0-openjdk-1.8.0.345-27.78.1
SUSE Linux Enterprise Server 12-SP2-BCL (src):    java-1_8_0-openjdk-1.8.0.345-27.78.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 14 Swamp Workflow Management 2022-08-19 19:20:01 UTC
SUSE-SU-2022:2856-1: An update that solves three vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1195163,1201684,1201692,1201694
CVE References: CVE-2022-21540,CVE-2022-21541,CVE-2022-34169
JIRA References: 
Sources used:
openSUSE Leap 15.4 (src):    java-1_8_0-openjdk-1.8.0.345-150000.3.70.1
openSUSE Leap 15.3 (src):    java-1_8_0-openjdk-1.8.0.345-150000.3.70.1
SUSE Manager Server 4.1 (src):    java-1_8_0-openjdk-1.8.0.345-150000.3.70.1
SUSE Manager Retail Branch Server 4.1 (src):    java-1_8_0-openjdk-1.8.0.345-150000.3.70.1
SUSE Manager Proxy 4.1 (src):    java-1_8_0-openjdk-1.8.0.345-150000.3.70.1
SUSE Linux Enterprise Server for SAP 15-SP2 (src):    java-1_8_0-openjdk-1.8.0.345-150000.3.70.1
SUSE Linux Enterprise Server for SAP 15-SP1 (src):    java-1_8_0-openjdk-1.8.0.345-150000.3.70.1
SUSE Linux Enterprise Server for SAP 15 (src):    java-1_8_0-openjdk-1.8.0.345-150000.3.70.1
SUSE Linux Enterprise Server 15-SP2-LTSS (src):    java-1_8_0-openjdk-1.8.0.345-150000.3.70.1
SUSE Linux Enterprise Server 15-SP1-LTSS (src):    java-1_8_0-openjdk-1.8.0.345-150000.3.70.1
SUSE Linux Enterprise Server 15-SP1-BCL (src):    java-1_8_0-openjdk-1.8.0.345-150000.3.70.1
SUSE Linux Enterprise Server 15-LTSS (src):    java-1_8_0-openjdk-1.8.0.345-150000.3.70.1
SUSE Linux Enterprise Module for Legacy Software 15-SP4 (src):    java-1_8_0-openjdk-1.8.0.345-150000.3.70.1
SUSE Linux Enterprise Module for Legacy Software 15-SP3 (src):    java-1_8_0-openjdk-1.8.0.345-150000.3.70.1
SUSE Enterprise Storage 7 (src):    java-1_8_0-openjdk-1.8.0.345-150000.3.70.1
SUSE Enterprise Storage 6 (src):    java-1_8_0-openjdk-1.8.0.345-150000.3.70.1
SUSE CaaS Platform 4.0 (src):    java-1_8_0-openjdk-1.8.0.345-150000.3.70.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 15 Swamp Workflow Management 2022-08-25 22:16:52 UTC
SUSE-SU-2022:2899-1: An update that solves four vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1201684,1201685,1201692,1201694,1202427
CVE References: CVE-2022-21540,CVE-2022-21541,CVE-2022-21549,CVE-2022-34169
JIRA References: 
Sources used:
SUSE OpenStack Cloud Crowbar 9 (src):    java-1_8_0-ibm-1.8.0_sr7.11-30.93.1
SUSE OpenStack Cloud 9 (src):    java-1_8_0-ibm-1.8.0_sr7.11-30.93.1
SUSE Linux Enterprise Software Development Kit 12-SP5 (src):    java-1_8_0-ibm-1.8.0_sr7.11-30.93.1
SUSE Linux Enterprise Server for SAP 12-SP4 (src):    java-1_8_0-ibm-1.8.0_sr7.11-30.93.1
SUSE Linux Enterprise Server 12-SP5 (src):    java-1_8_0-ibm-1.8.0_sr7.11-30.93.1
SUSE Linux Enterprise Server 12-SP4-LTSS (src):    java-1_8_0-ibm-1.8.0_sr7.11-30.93.1
SUSE Linux Enterprise Server 12-SP3-BCL (src):    java-1_8_0-ibm-1.8.0_sr7.11-30.93.1
SUSE Linux Enterprise Server 12-SP2-BCL (src):    java-1_8_0-ibm-1.8.0_sr7.11-30.93.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 16 Swamp Workflow Management 2022-08-25 22:17:56 UTC
SUSE-SU-2022:2898-1: An update that solves four vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1201684,1201685,1201692,1201694,1202427
CVE References: CVE-2022-21540,CVE-2022-21541,CVE-2022-21549,CVE-2022-34169
JIRA References: 
Sources used:
SUSE OpenStack Cloud Crowbar 9 (src):    java-1_7_1-ibm-1.7.1_sr5.15-38.74.1
SUSE OpenStack Cloud 9 (src):    java-1_7_1-ibm-1.7.1_sr5.15-38.74.1
SUSE Linux Enterprise Software Development Kit 12-SP5 (src):    java-1_7_1-ibm-1.7.1_sr5.15-38.74.1
SUSE Linux Enterprise Server for SAP 12-SP4 (src):    java-1_7_1-ibm-1.7.1_sr5.15-38.74.1
SUSE Linux Enterprise Server 12-SP5 (src):    java-1_7_1-ibm-1.7.1_sr5.15-38.74.1
SUSE Linux Enterprise Server 12-SP4-LTSS (src):    java-1_7_1-ibm-1.7.1_sr5.15-38.74.1
SUSE Linux Enterprise Server 12-SP3-BCL (src):    java-1_7_1-ibm-1.7.1_sr5.15-38.74.1
SUSE Linux Enterprise Server 12-SP2-BCL (src):    java-1_7_1-ibm-1.7.1_sr5.15-38.74.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 18 Swamp Workflow Management 2022-08-31 13:17:42 UTC
SUSE-SU-2022:2949-1: An update that solves four vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1201684,1201685,1201692,1201694,1202427
CVE References: CVE-2022-21540,CVE-2022-21541,CVE-2022-21549,CVE-2022-34169
JIRA References: 
Sources used:
openSUSE Leap 15.4 (src):    java-1_8_0-ibm-1.8.0_sr7.11-150000.3.62.1
openSUSE Leap 15.3 (src):    java-1_8_0-ibm-1.8.0_sr7.11-150000.3.62.1
SUSE Manager Server 4.1 (src):    java-1_8_0-ibm-1.8.0_sr7.11-150000.3.62.1
SUSE Manager Retail Branch Server 4.1 (src):    java-1_8_0-ibm-1.8.0_sr7.11-150000.3.62.1
SUSE Manager Proxy 4.1 (src):    java-1_8_0-ibm-1.8.0_sr7.11-150000.3.62.1
SUSE Linux Enterprise Server for SAP 15-SP2 (src):    java-1_8_0-ibm-1.8.0_sr7.11-150000.3.62.1
SUSE Linux Enterprise Server for SAP 15-SP1 (src):    java-1_8_0-ibm-1.8.0_sr7.11-150000.3.62.1
SUSE Linux Enterprise Server for SAP 15 (src):    java-1_8_0-ibm-1.8.0_sr7.11-150000.3.62.1
SUSE Linux Enterprise Server 15-SP2-LTSS (src):    java-1_8_0-ibm-1.8.0_sr7.11-150000.3.62.1
SUSE Linux Enterprise Server 15-SP1-LTSS (src):    java-1_8_0-ibm-1.8.0_sr7.11-150000.3.62.1
SUSE Linux Enterprise Server 15-SP1-BCL (src):    java-1_8_0-ibm-1.8.0_sr7.11-150000.3.62.1
SUSE Linux Enterprise Server 15-LTSS (src):    java-1_8_0-ibm-1.8.0_sr7.11-150000.3.62.1
SUSE Linux Enterprise Module for Legacy Software 15-SP4 (src):    java-1_8_0-ibm-1.8.0_sr7.11-150000.3.62.1
SUSE Linux Enterprise Module for Legacy Software 15-SP3 (src):    java-1_8_0-ibm-1.8.0_sr7.11-150000.3.62.1
SUSE Enterprise Storage 7 (src):    java-1_8_0-ibm-1.8.0_sr7.11-150000.3.62.1
SUSE Enterprise Storage 6 (src):    java-1_8_0-ibm-1.8.0_sr7.11-150000.3.62.1
SUSE CaaS Platform 4.0 (src):    java-1_8_0-ibm-1.8.0_sr7.11-150000.3.62.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 20 Swamp Workflow Management 2022-09-06 10:28:23 UTC
SUSE-SU-2022:3092-1: An update that fixes 9 vulnerabilities is now available.

Category: security (important)
Bug References: 1198671,1198672,1198673,1198674,1198675,1198935,1201684,1201692,1201694
CVE References: CVE-2021-41041,CVE-2022-21426,CVE-2022-21434,CVE-2022-21443,CVE-2022-21476,CVE-2022-21496,CVE-2022-21540,CVE-2022-21541,CVE-2022-34169
JIRA References: 
Sources used:
openSUSE Leap 15.4 (src):    java-1_8_0-openj9-1.8.0.345-150200.3.24.1
openSUSE Leap 15.3 (src):    java-1_8_0-openj9-1.8.0.345-150200.3.24.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 22 Swamp Workflow Management 2022-09-07 16:27:18 UTC
SUSE-SU-2022:3152-1: An update that solves four vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1201684,1201685,1201692,1201694,1202427
CVE References: CVE-2022-21540,CVE-2022-21541,CVE-2022-21549,CVE-2022-34169
JIRA References: 
Sources used:
SUSE OpenStack Cloud Crowbar 9 (src):    java-1_8_0-ibm-1.8.0_sr7.15-30.96.1
SUSE OpenStack Cloud 9 (src):    java-1_8_0-ibm-1.8.0_sr7.15-30.96.1
SUSE Linux Enterprise Software Development Kit 12-SP5 (src):    java-1_8_0-ibm-1.8.0_sr7.15-30.96.1
SUSE Linux Enterprise Server for SAP 12-SP4 (src):    java-1_8_0-ibm-1.8.0_sr7.15-30.96.1
SUSE Linux Enterprise Server 12-SP5 (src):    java-1_8_0-ibm-1.8.0_sr7.15-30.96.1
SUSE Linux Enterprise Server 12-SP4-LTSS (src):    java-1_8_0-ibm-1.8.0_sr7.15-30.96.1
SUSE Linux Enterprise Server 12-SP3-BCL (src):    java-1_8_0-ibm-1.8.0_sr7.15-30.96.1
SUSE Linux Enterprise Server 12-SP2-BCL (src):    java-1_8_0-ibm-1.8.0_sr7.15-30.96.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.