Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.1
CVE-2022-44729: Apache Batik SVG handling may expose internal information
CVE-2022-44729 · published 3 years ago
Summary
The Batik library version 1.16 can be tricked by a crafted SVG file to load outside resources, which could use up server resources or reveal data it shouldn't. This happens automatically unless the software is updated. Upgrade Batik to version 1.17 or later to stop the risk.
What to do
- Update apache org.apache.xmlgraphics:batik-bridge to version 1.17.
- Update apache org.apache.xmlgraphics:batik-svgrasterizer to version 1.17.
- Update apache org.apache.xmlgraphics:batik-transcoder to version 1.17.
- Update debian batik to version 1.16+dfsg-1+deb12u1.
- Update debian batik to version 1.17+dfsg-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| maven | apache | org.apache.xmlgraphics:batik-bridge |
>= 1.0, < 1.17 Fix: upgrade to 1.17
|
| maven | apache | org.apache.xmlgraphics:batik-svgrasterizer |
>= 1.0, < 1.17 Fix: upgrade to 1.17
|
| maven | apache | org.apache.xmlgraphics:batik-transcoder |
>= 1.0, < 1.17 Fix: upgrade to 1.17
|
| – | apache | xml_graphics_batik |
>= 1.0, <= 1.16 cpe:2.3:a:apache:xml_graphics_batik:*:*:*:*:*:*:*:* |
| – | debian | debian_linux |
10.0 cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* |
| Ubuntu:18.04:LTS | canonical | batik | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | batik | All versions |
| Ubuntu:20.04:LTS | canonical | batik | All versions |
| Ubuntu:22.04:LTS | canonical | batik | All versions |
| Ubuntu:24.04:LTS | canonical | batik | All versions |
| Ubuntu:25.10 | canonical | batik | All versions |
| Ubuntu:26.04 | canonical | batik | All versions |
| – | apache software foundation | apache xml graphics batik | 1.16 |
| Debian:12 | debian | batik |
< 1.16+dfsg-1+deb12u1 Fix: upgrade to 1.16+dfsg-1+deb12u1
|
| Debian:13 | debian | batik |
< 1.17+dfsg-1 Fix: upgrade to 1.17+dfsg-1
|
Original advisory text
Apache XML Graphics Batik: Information disclosure vulnerability
Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. On version 1.16, a malicious SVG could trigger loading external resources by default, causing resource consumption or in some cases even information disclosure. Users are recommended to upgrade to version 1.17 or later.
References
- https://nvd.nist.gov/vuln/detail/CVE-2022-44729
- https://github.com/apache/xmlgraphics-batik/commit/85b3457d9902f64d5d409a8da060d...
- https://github.com/apache/xmlgraphics-batik/commit/aaa1dd3e6b5a7df781d73e0c37a1d...
- https://github.com/advisories/GHSA-gq5f-xv48-2365
- https://issues.apache.org/jira/browse/BATIK-1349 Third Party Advisory
- https://security.gentoo.org/glsa/202401-11
- http://www.openwall.com/lists/oss-security/2023/08/22/4 Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/10/msg00021.html Mailing List
- http://www.openwall.com/lists/oss-security/2023/08/22/2 Third Party Advisory
- https://lists.apache.org/thread/hco2nw1typoorz33qzs0fcdx0ws6d6j2 Third Party Advisory
- https://xmlgraphics.apache.org/security.html Third Party Advisory
- https://ubuntu.com/security/CVE-2022-44729 Third Party Advisory
- https://www.openwall.com/lists/oss-security/2023/08/22/2 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2022-44729 Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2022-44729 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-918Server-Side Request Forgery (SSRF)
Timeline
Published22 Aug 2023
Updated3 Nov 2026
First seen6 Mar 2026
Sources
GHSA-gq5f-xv48-2365 · GHSA
CVE-2022-44729 · NVD
UBUNTU-CVE-2022-44729 · OSV
CVE-2022-44729 · MITRE
DEBIAN-CVE-2022-44729 · OSV
Track software like this
Free during beta