Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-44730: Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. A malicious SVG can probe user profile / data and send it directly as parameter to a URL. CVE-2022-44729: Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. On version 1.16, a malicious SVG could trigger loading external resources by default, causing resource consumption or in some cases even information disclosure. Users are recommended to upgrade to version 1.17 or later.
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | batik | 0:1.8-0.12.svn1230816.amzn2.0.2 |
| Amazon Linux · 2 | batik-demo | 0:1.8-0.12.svn1230816.amzn2.0.2 |
| Amazon Linux · 2 | batik-javadoc | 0:1.8-0.12.svn1230816.amzn2.0.2 |
| Amazon Linux · 2 | batik-rasterizer | 0:1.8-0.12.svn1230816.amzn2.0.2 |
| Amazon Linux · 2 | batik-slideshow | 0:1.8-0.12.svn1230816.amzn2.0.2 |
| Amazon Linux · 2 | batik-squiggle | 0:1.8-0.12.svn1230816.amzn2.0.2 |
| Amazon Linux · 2 | batik-svgpp | 0:1.8-0.12.svn1230816.amzn2.0.2 |
| Amazon Linux · 2 | batik-ttf2svg | 0:1.8-0.12.svn1230816.amzn2.0.2 |
Vulnerabilities 2
-
High 7.1
Apache XML Graphics Batik: Information disclosure vulnerability
Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. On version 1.16, a malicious SVG could trigger loading external resources by default, causing resource…
-
Medium 4.4
Apache XML Graphics Batik: Information disclosure vulnerability
Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. A malicious SVG can probe user profile / data and send it directly as parameter to a URL.