Skip to content
OpenAdvisories
High ALSA-2023:0005 1 CVE

Important: bcel security update

Published Jan 2, 2023 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The Byte Code Engineering Library (Apache Commons BCEL) is intended to give users a convenient way to analyze, create, and manipulate (binary) Java class files (those ending with .class).

Security Fix(es):

* Apache-Commons-BCEL: arbitrary bytecode produced via out-of-bounds writing (CVE-2022-42920)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 1

ReleasePackageFixed in
AlmaLinux · 9 bcel 6.4.1-9.el9_1

Vulnerabilities 1

  • Critical 9.8
    CVE-2022-42920

    Apache Commons BCEL prior to 6.6.0 allows producing arbitrary bytecode via out-of-bounds writing

    Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds writing issue, these APIs can be used to produce arbitrary bytecode. This could be abused in applications that pa…

    Apache Software Foundation Apache Commons BCEL bcel bcel Debian Ubuntu Azure Linux Maven

References

  • report
    https://access.redhat.com/security/cve/CVE-2022-42920
  • report
    https://bugzilla.redhat.com/2142707
  • advisory
    https://errata.almalinux.org/9/ALSA-2023-0005.html