CVE-2020-11987

Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.

Batik is an inline templating engine for CoffeeScript, inspired by CoffeeKup, that lets you write your template directly as a CoffeeScript function.

Security Fix(es):

Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.(CVE-2020-11987)

Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.

TuxCare rebuilt 27 org.apache.xmlgraphics packages to address 10 CVEs. Fixed in 1.7-tuxcare.1.

The Apache Batik library is vulnerable to SSRF via the NodePickerPanel that allow an attacker to cause the underlying server to make arbitrary GET requests (CVE-2020-11987).

A flaw was found in the Apache Batik library, where it is vulnerable to a Server-Side Request Forgery attack (SSRF) via "xlink:href" attributes. This flaw allows an attacker to cause the underlying server to make arbitrary GET requests. The highest threat from this vulnerability is to system integrity (CVE-2019-17566).

The Apache Batik library is vulnerable to SSRF via the NodePickerPanel that allow an attacker to cause the underlying server to make arbitrary GET requests (CVE-2020-11987).

These are all security issues fixed in the xmlgraphics-batik-1.15-2.1 package on the GA media of openSUSE Tumbleweed.

This update for xmlgraphics-batik fixes the following issues:

• CVE-2017-5662: Fixed Apache Batik information disclosure vulnerability (bsc#1034675).
• CVE-2019-17566: Fixed SSRF vulnerability (bsc#1172961).
• CVE-2020-11987: Fixed Apache XML Graphics Batik SSRF vulnerability (bsc#1182748).
• CVE-2022-38398: Fixed information disclosure vulnerability (bsc#1203674).
• CVE-2022-38648: Fixed information disclosure vulnerability (bsc#1203673).
• CVE-2022-40146: Fixed information disclosure vulnerability (bsc#1203672).
• CVE-2022-41704: Fixed information disclosure vulnerability in Apache Batik (bsc#1204704).
• CVE-2022-42890: Fixed information disclosure vulnerability in Apache Batik (bsc#1204709).
• CVE-2022-44729: Fixed Server-Side Request Forgery.
• CVE-2022-44730: Fixed Server-Side Request Forgery.

Upgrade to version 1.17.

It was discovered that Apache Batik incorrectly handled certain inputs. An attacker could possibly use this to perform a cross site request forgery attack. (CVE-2019-17566, CVE-2020-11987, CVE-2022-38398, CVE-2022-38648)

It was discovered that Apache Batik incorrectly handled Jar URLs in some situations. A remote attacker could use this issue to access files on the server. (CVE-2022-40146)

It was discovered that Apache Batik allowed running untrusted Java code from an SVG. An attacker could use this issue to cause a denial of service, or possibly execute arbitrary code. (CVE-2022-41704, CVE-2022-42890)