Debian 10 Buster DLA-3619-1 Moderate: SSRF Issues in Batik Fixed

debian lts

October 14, 2023

Batik is a toolkit for applications or applets that want to use images in the Scalable Vector Graphics (SVG) format for various purposes, such as viewing, generation or manipulatio...

Topics Covered

security advisory security issue software update debian ssrf batik

Summary

CVE-2020-11987

A server-side request forgery was found,
caused by improper input validation by the NodePickerPanel.
By using a specially-crafted argument, an attacker could exploit
this vulnerability to cause the underlying server to make
arbitrary GET requests.

CVE-2022-38398

A Server-Side Request Forgery (SSRF) vulnerability
was found that allows an attacker to load a url thru the jar
protocol.

CVE-2022-38648

A Server-Side Request Forgery (SSRF) vulnerability
was found that allows an attacker to fetch external resources.

CVE-2022-40146

A Server-Side Request Forgery (SSRF) vulnerability
was found that allows an attacker to access files using a Jar url.

CVE-2022-44729

A Server-Side Request Forgery (SSRF) vulnerability
was found. A malicious SVG could trigger loading external resources
by default, causing resource consumption or in some
cases even information disclosure.

CVE-2022-44730

A Server-Side Request Forgery (SSRF) vulnerability