Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2022-39135: Apache Calcite XML handling can be tricked
CVE-2022-39135 · published 4 years ago
Summary
Certain functions in Apache Calcite versions before 1.32 let specially crafted XML data cause the software to read external files or network resources. This could let an attacker gain information or cause unwanted actions when those functions are used. Upgrade to version 1.32 or later, or disable the affected functions, to stop the risk.
What to do
- Update apache org.apache.calcite:calcite-core to version 1.32.0.
- Update org.apache.calcite:calcite-core to version 1.32.0.
- Update apache calcite to version 1.32.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| maven | apache | org.apache.calcite:calcite-core |
< 1.32.0 Fix: upgrade to 1.32.0
|
| – | apache | calcite |
>= 1.22.0, < 1.32.0 cpe:2.3:a:apache:calcite:*:*:*:*:*:*:*:* |
| maven | – | org.apache.calcite:calcite-core |
>= 1.22.0, < 1.32.0 Fix: upgrade to 1.32.0
|
Original advisory text
Apache Calcite: potential XEE attacks
Apache Calcite 1.22.0 introduced the SQL operators EXISTS_NODE, EXTRACT_XML, XML_TRANSFORM and EXTRACT_VALUE do not restrict XML External Entity references in their configuration, making them vulnerable to a potential XML External Entity (XXE) attack. Therefore any client exposing these operators, typically by using Oracle dialect (the first three) or MySQL dialect (the last one), is affected by this vulnerability (the extent of it will depend on the user under which the application is running). From Apache Calcite 1.32.0 onwards, Document Type Declarations and XML External Entity resolution are disabled on the impacted operators.
References
- https://lists.apache.org/thread/ohdnhlgm6jvt3srw8l7spkm2d5vwm082 URL
- https://nvd.nist.gov/vuln/detail/CVE-2022-39135 Vendor Advisory
- http://www.openwall.com/lists/oss-security/2022/11/21/3 Third Party Advisory
- https://github.com/apache/calcite/blob/calcite-1.31.0/core/src/main/java/org/apa...
- https://github.com/apache/calcite/blob/calcite-1.32.0/core/src/main/java/org/apa...
- https://github.com/apache/calcite/commit/1ddc1c3a0c61
- https://github.com/apache/calcite/commit/ba80b9156afc0db26b194d97a031fcc0dc7f4c0...
- https://calcite.apache.org/news/2022/09/10/release-1.32.0
- https://github.com/apache/calcite/blob/calcite-1.22.0/core/src/main/java/org/apa...
- https://github.com/apache/calcite/tree/calcite-1.19.0/core/src/main/java/org/apa...
- https://issues.apache.org/jira/browse/CALCITE-5263
- https://security.snyk.io/vuln/SNYK-JAVA-ORGAPACHECALCITE-3021143
- https://github.com/advisories/GHSA-fj2m-w3wv-x9pr
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39135... Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-611XML External Entity (XXE)
Timeline
Published11 Sep 2022
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta