๐ Iโm interested in DevOps and infrastructure technologies - Microsoft Azure, Redhat Openshift, Kafka Debezium, Online Integrated Development Environments (IDE) like Codespaces and Gitpod, Python, and Java.
๐ฑ Iโm currently learning the above technologies
๐๏ธ Iโm looking to volunteer on open source projects
Xalan-Java is an XSLT processor for transforming XML documents into HTML,
text, or other XML document types. It implements XSL Transformations (XSLT)
Version 1.0 and XML Path Language (XPath) Version 1.0 and can be used from
the command line, in an applet or a servlet, or as a module in other program.
Path to vulnerable library: /xalan/2.7.2/xalan-2.7.2.jar
Dependency Hierarchy:
โ xalan-2.7.2.jar (Vulnerable Library)
Found in base branch: main
Vulnerability Details
The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. The Apache Xalan Java project is dormant and in the process of being retired. No future releases of Apache Xalan Java to address this issue are expected. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.