CVE-2022-44729 Apache XML Graphics Batik: Information disclosure vulnerability
HighCVSS 7.1
EPSS 0.92%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16.
On version 1.16, a malicious SVG could trigger loading external resources by default, causing resource consumption or in some cases even information disclosure. Users are recommended to upgrade to version 1.17 or later.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.xmlgraphics/batik-bridge(Maven) | >= 1.0, < 1.17 | 1.17 |
| org.apache.xmlgraphics/batik-bridge(Maven) | = 1.10 | No fix listed |
| org.apache.xmlgraphics/batik-bridge(Maven) | = 1.11 | No fix listed |
| org.apache.xmlgraphics/batik-bridge(Maven) | = 1.12 | No fix listed |
| org.apache.xmlgraphics/batik-bridge(Maven) | = 1.13 | No fix listed |
| org.apache.xmlgraphics/batik-bridge(Maven) | = 1.14 | No fix listed |
| org.apache.xmlgraphics/batik-bridge(Maven) | = 1.15 | No fix listed |
| org.apache.xmlgraphics/batik-bridge(Maven) | = 1.16 | No fix listed |
| org.apache.xmlgraphics/batik-bridge(Maven) | = 1.6.1 | No fix listed |
| org.apache.xmlgraphics/batik-bridge(Maven) | = 1.7 | No fix listed |
| org.apache.xmlgraphics/batik-bridge(Maven) | = 1.8 | No fix listed |
| org.apache.xmlgraphics/batik-bridge(Maven) | = 1.9 | No fix listed |
| org.apache.xmlgraphics/batik-bridge(Maven) | = 1.9.1 | No fix listed |
| org.apache.xmlgraphics/batik-svgrasterizer(Maven) | >= 1.0, < 1.17 | 1.17 |
| org.apache.xmlgraphics/batik-svgrasterizer(Maven) | = 1.10 | No fix listed |
| org.apache.xmlgraphics/batik-svgrasterizer(Maven) | = 1.11 | No fix listed |
| org.apache.xmlgraphics/batik-svgrasterizer(Maven) | = 1.12 | No fix listed |
| org.apache.xmlgraphics/batik-svgrasterizer(Maven) | = 1.13 | No fix listed |
| org.apache.xmlgraphics/batik-svgrasterizer(Maven) | = 1.14 | No fix listed |
| org.apache.xmlgraphics/batik-svgrasterizer(Maven) | = 1.15 | No fix listed |
| org.apache.xmlgraphics/batik-svgrasterizer(Maven) | = 1.16 | No fix listed |
| org.apache.xmlgraphics/batik-svgrasterizer(Maven) | = 1.9 | No fix listed |
| org.apache.xmlgraphics/batik-svgrasterizer(Maven) | = 1.9.1 | No fix listed |
| org.apache.xmlgraphics/batik-transcoder(Maven) | >= 1.0, < 1.17 | 1.17 |
| org.apache.xmlgraphics/batik-transcoder(Maven) | = 1.10 | No fix listed |
Show 22 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.xmlgraphics/batik-transcoder(Maven) | = 1.11 | No fix listed |
| org.apache.xmlgraphics/batik-transcoder(Maven) | = 1.12 | No fix listed |
| org.apache.xmlgraphics/batik-transcoder(Maven) | = 1.13 | No fix listed |
| org.apache.xmlgraphics/batik-transcoder(Maven) | = 1.14 | No fix listed |
| org.apache.xmlgraphics/batik-transcoder(Maven) | = 1.15 | No fix listed |
| org.apache.xmlgraphics/batik-transcoder(Maven) | = 1.16 | No fix listed |
| org.apache.xmlgraphics/batik-transcoder(Maven) | = 1.6.1 | No fix listed |
| org.apache.xmlgraphics/batik-transcoder(Maven) | = 1.7 | No fix listed |
| org.apache.xmlgraphics/batik-transcoder(Maven) | = 1.8 | No fix listed |
| org.apache.xmlgraphics/batik-transcoder(Maven) | = 1.9 | No fix listed |
| org.apache.xmlgraphics/batik-transcoder(Maven) | = 1.9.1 | No fix listed |
| debian/batik(Debian:12) | < 1.16+dfsg-1+deb12u1 | 1.16+dfsg-1+deb12u1 |
| debian/batik(Debian:12) | = 1.16+dfsg-1 | No fix listed |
| debian/batik(Debian:13) | < 1.17+dfsg-1 | 1.17+dfsg-1 |
| debian/batik(Debian:14) | < 1.17+dfsg-1 | 1.17+dfsg-1 |
| Apache XML Graphics Batik | = 1.16 | No fix listed |
| ubuntu/batik(Ubuntu:22.04) | All versions | No fix listed |
| ubuntu/batik(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/batik(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/batik(Ubuntu:26.10) | All versions | No fix listed |
| apache xml graphics batik | >= 1.0, <= 1.16 | No fix listed |
| debian linux | = 10.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- github.com product
- issues.apache.org
- lists.apache.org mailing-list vendor-advisory
- lists.debian.org mailing-list
- security.gentoo.org
- xmlgraphics.apache.org vendor-advisory
- www.openwall.com mailing-list third-party-advisory
- www.openwall.com mailing-list third-party-advisory
- github.com
- Debian Security Tracker CVE-2022-44729 vendor-advisory
- Ubuntu CVE tracker vendor-advisory
- www.cve.org