CVE-2019-17566

Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attributes. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.

Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attributes. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.

TuxCare rebuilt 27 org.apache.xmlgraphics packages to address 10 CVEs. Fixed in 1.7-tuxcare.1.

A flaw was found in the Apache Batik library, where it is vulnerable to a Server-Side Request Forgery attack (SSRF) via "xlink:href" attributes. This flaw allows an attacker to cause the underlying server to make arbitrary GET requests. The highest threat from this vulnerability is to system integrity (CVE-2019-17566).

The Apache Batik library is vulnerable to SSRF via the NodePickerPanel that allow an attacker to cause the underlying server to make arbitrary GET requests (CVE-2020-11987).

This update for xmlgraphics-batik fixes the following issues:

• CVE-2019-17566: Fixed a SSRF which might have allowed the underlying server to make arbitrary GET requests (bsc#1172961).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for xmlgraphics-batik fixes the following issues:

• CVE-2019-17566: Fixed a SSRF which might have allowed the underlying server to make arbitrary GET requests (bsc#1172961).

This update was imported from the SUSE:SLE-15-SP1:Update update project. This update was imported from the openSUSE:Leap:15.1:Update update project.

These are all security issues fixed in the xmlgraphics-batik-1.14-2.5 package on the GA media of openSUSE Tumbleweed.

This update for xmlgraphics-batik fixes the following issues:

• CVE-2019-17566: Fixed a SSRF which might have allowed the underlying server to make arbitrary GET requests (bsc#1172961).

This update for xmlgraphics-batik fixes the following issues:

• CVE-2017-5662: Fixed Apache Batik information disclosure vulnerability (bsc#1034675).
• CVE-2019-17566: Fixed SSRF vulnerability (bsc#1172961).
• CVE-2020-11987: Fixed Apache XML Graphics Batik SSRF vulnerability (bsc#1182748).
• CVE-2022-38398: Fixed information disclosure vulnerability (bsc#1203674).
• CVE-2022-38648: Fixed information disclosure vulnerability (bsc#1203673).
• CVE-2022-40146: Fixed information disclosure vulnerability (bsc#1203672).
• CVE-2022-41704: Fixed information disclosure vulnerability in Apache Batik (bsc#1204704).
• CVE-2022-42890: Fixed information disclosure vulnerability in Apache Batik (bsc#1204709).
• CVE-2022-44729: Fixed Server-Side Request Forgery.
• CVE-2022-44730: Fixed Server-Side Request Forgery.

Upgrade to version 1.17.

It was discovered that Apache Batik incorrectly handled certain inputs. An attacker could possibly use this to perform a cross site request forgery attack. (CVE-2019-17566, CVE-2020-11987, CVE-2022-38398, CVE-2022-38648)

It was discovered that Apache Batik incorrectly handled Jar URLs in some situations. A remote attacker could use this issue to access files on the server. (CVE-2022-40146)

It was discovered that Apache Batik allowed running untrusted Java code from an SVG. An attacker could use this issue to cause a denial of service, or possibly execute arbitrary code. (CVE-2022-41704, CVE-2022-42890)