Not rated
CVE-2022-42920 Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics
Description
Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds writing issue, these APIs can be used to produce arbitrary bytecode. This could be abused in applications that pass attacker-controllable data to those APIs, giving the attacker more control over the resulting bytecode than otherwise expected. Update to Apache Commons BCEL 6.6.0.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Commons BCEL 6.6 | earliest → < 6.6.0 | 6.6.0 |
References
- lists.apache.org lists.apache.org
- [oss-security] 20221107 Re: CVE-2022-42920: Apache Commons BCEL prior to 6.6.0 allows producing arbitrary bytecode via out-of-bounds writing www.openwall.com
- FEDORA-2022-01a56f581c lists.fedoraproject.org
- FEDORA-2022-0e358addb8 lists.fedoraproject.org
- FEDORA-2022-f60a52e054 lists.fedoraproject.org
- GLSA-202401-25 security.gentoo.org
Timeline
- Published
- Last modified