search

apache / jmeter

Apache JMeter open-source load testing tool for analyzing and measuring the performance of a variety of services
https://jmeter.apache.org/
Apache License 2.0
8.43k stars 2.11k forks source link

CVE-2022-44729 Apache XML Graphics Batik v1.16 Server-Side Request Forgery vulnerability #6241

Open nkshschdv opened 9 months ago

nkshschdv commented 9 months ago

Microsoft Defender for cloud on Azure has detected a vulnerability CVE-2022-44729 in apache-jmeter-5.6.3 Please find report below `Critical and High severity vulnerabilities detected in your CNAB bundle by scanning referenced images with Microsoft Defender for Cloud. To know more about the vulnerability scanning process go to https://aka.ms/Container-Certification-Vulnerability-Found. Details about the Vulnerabilities detected are: Source image: xxxxxxxx.azurecr.io/xxxxxxx Image digestId: sha256:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx VulnerabilityId: 994981 CVSS version 3 score: 7.1 CVE Ids: link= http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-44729 and CveId= CVE-2022-44729

Vulnerability Information: Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. Remediation Steps: Refer to Github security advisory GHSA-gq5f-xv48-2365 for updates and patch information.

Patch:

Following are links for downloading patches to fix the vulnerabilities:

GHSA-gq5f-xv48-2365:org.apache.xmlgraphics:batik-bridge

`

On searching my container , i can find following location as showing in screenshot leading to jmeter installation image

Actual behavior

The version for

  1. org.apache.xmlgraphics:batik-bridge
  2. org.apache.xmlgraphics:batik-transcoder should be 1.17 or higher

Steps to reproduce the problem

  1. Install the jmeter in Ubuntu Linux
  2. search the keyword using "find / -path /proc -prune -o -iname "batik" -print"
  3. Some of the results will point to version of batik-bridge 1.16 and batik-transcoder 1.16 , a vulnerable version

JMeter Version

5.6.3

Java Version

openjdk version "11.0.22" 2024-01-16

OS Version

Linux 62ef50357f09 5.15.0-1057-azure #65~20.04.1-Ubuntu SMP Mon Feb 12 17:26:40 UTC 2024 x86_64 GNU/Linux

akasturia commented 2 months ago

Hi Team , is this something that is planned to be fixed and rolled out soon ?