batik - security update

Fixed packages 1

Vulnerabilities 4

• High 8.2
  CVE-2020-11987 EPSS 14%

  Server-side request forgery (SSRF) in Apache Batik

  Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GE…

  batik batik org.apache.xmlgraphics:batik-svgbrowser Debian Ubuntu Maven
  Feb 24, 2021
• High 7.5
  CVE-2022-40146 Public exploit

  Jar url should be blocked by DefaultScriptSecurity

  Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to access files using a Jar url. This issue affects Apache XML Graphics Batik 1.14.

  Apache Software Foundation Apache XML Graphics batik batik Debian Ubuntu Maven
  Sep 22, 2022
• Medium 5.3
  CVE-2022-38398

  Server-Side Request Forgery Information Disclosure Vulnerability

  Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to load a url thru the jar protocol. This issue affects Apache XML Graphics Batik 1.14.

  Apache Software Foundation Apache XML Graphics batik batik Debian Ubuntu Maven
  Sep 22, 2022
• Medium 5.3
  CVE-2022-38648

  PDFTranscoder does not block external resources

  Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources. This issue affects Apache XML Graphics Batik 1.14.

  Apache Software Foundation Apache XML Graphics batik batik Debian Ubuntu Maven
  Sep 22, 2022