Skip to content
OpenAdvisories
Critical · 9.8 CVE-2022-42920 EUVD-2022-7295GHSA-97xg-phpr-rg8q

Apache Commons BCEL prior to 6.6.0 allows producing arbitrary bytecode via out-of-bounds writing

Published Nov 7, 2022 · Updated Aug 3, 2024 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Commons BCEL Package: bcel Package: bcel Package: bcel Package: org.apache.bcel:bcel Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Maven Ecosystem: Ubuntu

Description

Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds writing issue, these APIs can be used to produce arbitrary bytecode. This could be abused in applications that pass attacker-controllable data to those APIs, giving the attacker more control over the resulting bytecode than otherwise expected. Update to Apache Commons BCEL 6.6.0.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache Commons BCEL Apache Commons BCEL – < 6.6.0 6.6.0

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 bcel 6.5.0-2 —
Debian 13 bcel 6.5.0-2 —
Debian 12 bcel 6.5.0-2 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 22.04 LTS bcel 6.5.0-1ubuntu0.1 USN-7208-1
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS bcel 6.4.1-1ubuntu0.1~esm1 USN-7208-1
Ubuntu Pro 18.04 LTS bcel 6.2-1ubuntu0.1~esm1 USN-7208-1
Ubuntu Pro 16.04 LTS bcel 6.0~rc3-2ubuntu1+esm1 USN-7208-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 9 bcel 6.4.1-9.el9_1 RHSA-2023:0005
RHEL 7 bcel +1 5.2-19.el7_9 RHSA-2022:8958
RHEL 3 rh-maven36-bcel +1 6.3.1-2.3.el7 RHSA-2022:8959
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 9.0 EUS bcel 6.4.1-9.el9_0 RHSA-2023:0004

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 9 bcel 6.4.1-9.el9_1 ALSA-2023:0005

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 9 bcel 6.4.1-9.el9_1 RLSA-2023:0005

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP4 bcel 5.2-150200.11.3.1 SUSE-SU-2022:4306-1
SLES 15 SP3 bcel 5.2-150200.11.3.1 SUSE-SU-2022:4306-1
SLES 12 SP5 bcel 5.2-28.3.1 SUSE-SU-2022:4331-1
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 12 SP5 bcel 5.2-28.3.1 SUSE-SU-2022:4331-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed bcel 5.2-37.1 openSUSE-SU-2024:12530-1
openSUSE Leap 15.4 bcel 5.2-150200.11.3.1 SUSE-SU-2022:4306-1
openSUSE Leap 15.3 bcel 5.2-150200.11.3.1 SUSE-SU-2022:4306-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 bcel +1 6.5.0-3.amzn2023.0.2 ALAS2023-2023-105
Amazon Linux 2 bcel +1 5.2-18.amzn2.0.1 ALAS2-2023-1916

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 bcel No fix yet —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 9 bcel 6.4.1-9.el9_1 ELSA-2023-0005
Oracle Linux 7 bcel +1 5.2-19.el7_9 ELSA-2022-8958

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.bcel:bcel < 6.6.0 6.6.0 GHSA-97xg-phpr-rg8q

Advisories 30

References