~ / search / GHSA-v92f-jx6p-73rx

GHSA-v92f-jx6p-73rx

Improper Control of Generation of Code ('Code Injection') in jai-ext

Source: GitHub Advisory Database (reviewed) Critical CVE-2022-24816

Packages

EcosystemPackageAffectedFixed in
Maven it.geosolutions.jaiext.jiffle:jt-jiffle < 1.1.22 1.1.22
Maven it.geosolutions.jaiext.jiffle:jt-jiffle-language < 1.1.22 1.1.22

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Programs using jt-jiffle, and allowing Jiffle script to be provided via network request, are susceptible to a Remote Code Execution as the Jiffle script is compiled into Java code via Janino, and executed. In particular, this affects the downstream GeoServer project. ### Patches Version 1.2.22 will contain a patch that disables the ability to inject malicious code into the resulting script. ### Workarounds Negate the ability to compile Jiffle scripts from the final application, by removing janino-x.y.z.jar from the classpath. ### References None.

References

External links from the advisory. They lead to third-party sites.