Alerts This Week
Warning Icon 1 692
Alerts This Week
Warning Icon 1 692

Mageia 7: 2021-0168 Critical SSRF Attack Fix for Apache Batik

mageia
Calendar Grey April 2, 2021
Dist Mageia Esm H88
Essential security patches for Apache Batik in Mageia address SSRF and integrity vulnerabilities as of April 2021.
A flaw was found in the Apache Batik library, where it is vulnerable to a Server-Side Request Forgery attack (SSRF) via "xlink:href" attributes

Summary

A flaw was found in the Apache Batik library, where it is vulnerable to a Server-Side Request Forgery attack (SSRF) via "xlink:href" attributes. This flaw allows an attacker to cause the underlying server to make arbitrary GET requests. The highest threat from this vulnerability is to system integrity (CVE-2019-17566).
The Apache Batik library is vulnerable to SSRF via the NodePickerPanel that allow an attacker to cause the underlying server to make arbitrary GET requests (CVE-2020-11987).

References

- https://bugs.mageia.org/show_bug.cgi?id=26800

- https://www.openwall.com/lists/oss-security/2021/02/24/2

- https://xmlgraphics.apache.org/security.html

- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/N3V3MJVGDUNTVPXXGYR335PZJJK7LDXC/

- https://www.cve.org/CVERecord?id=CVE-2019-17566

- https://www.cve.org/CVERecord?id=CVE-2020-11987

Topics%20covered

Topics Covered

security advisory system integrity apache batik ssrf attack mageia 7

Resolution

SRPMS

- 7/core/batik-1.13-1.3.mga7

Severity
critical
Lowest
Low
Medium
High
Critical

Publication date: 02 Apr 2021
URL: https://advisories.mageia.org/MGASA-2021-0168.html
Type: security
CVE: CVE-2019-17566, CVE-2020-11987

Topics%20covered

Topics Covered

security advisory system integrity apache batik ssrf attack mageia 7

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here