{
	"document":{
		"aggregate_severity":{
			"namespace":"https://nvd.nist.gov/vuln-metrics/cvss",
			"text":"High"
		},
		"category":"csaf_vex",
		"csaf_version":"2.0",
		"distribution":{
			"tlp":{
				"label":"WHITE",
				"url":"https:/www.first.org/tlp/"
			}
		},
		"lang":"en",
		"notes":[
			{
				"text":"bcel security update",
				"category":"general",
				"title":"Synopsis"
			},
			{
				"text":"An update for bcel is now available for openEuler-20.03-LTS-SP1,openEuler-20.03-LTS-SP3 and openEuler-22.03-LTS.",
				"category":"general",
				"title":"Summary"
			},
			{
				"text":"The Byte Code Engineering Library (formerly known as JavaClass) is intended to give users a convenient possibility to analyze, create, and manipulate (binary) Java class files (those ending with .class).\n\nSecurity Fix(es):\n\nThe Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. The Apache Xalan Java project is dormant and in the process of being retired. No future releases of Apache Xalan Java to address this issue are expected. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.(CVE-2022-34169)",
				"category":"general",
				"title":"Description"
			},
			{
				"text":"An update for bcel is now available for openEuler-20.03-LTS-SP1,openEuler-20.03-LTS-SP3 and openEuler-22.03-LTS.\n\nopenEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.",
				"category":"general",
				"title":"Topic"
			},
			{
				"text":"High",
				"category":"general",
				"title":"Severity"
			},
			{
				"text":"bcel",
				"category":"general",
				"title":"Affected Component"
			}
		],
		"publisher":{
			"issuing_authority":"openEuler security committee",
			"name":"openEuler",
			"namespace":"https://www.openeuler.org",
			"contact_details":"openeuler-security@openeuler.org",
			"category":"vendor"
		},
		"references":[
			{
				"summary":"openEuler-SA-2022-1977",
				"category":"self",
				"url":"https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2022-1977"
			},
			{
				"summary":"CVE-2022-34169",
				"category":"self",
				"url":"https://www.openeuler.org/en/security/cve/detail?cveId=CVE-2022-34169&packageName=bcel"
			},
			{
				"summary":"nvd cve",
				"category":"external",
				"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-34169"
			},
			{
				"summary":"openEuler-SA-2022-1977 vex file",
				"category":"self",
				"url":"https://repo.openeuler.org/security/data/csaf/advisories/2022/csaf-openeuler-sa-2022-1977.json"
			}
		],
		"title":"An update for bcel is now available for openEuler-20.03-LTS-SP1,openEuler-20.03-LTS-SP3 and openEuler-22.03-LTS",
		"tracking":{
			"initial_release_date":"2022-09-30T09:46:53+08:00",
			"revision_history":[
				{
					"date":"2022-09-30T09:46:53+08:00",
					"summary":"Initial",
					"number":"1.0.0"
				},
				{
					"date":"2024-10-31T09:46:53+08:00",
					"summary":"final",
					"number":"2.0.0"
				}
			],
			"generator":{
				"date":"2024-10-31T09:46:53+08:00",
				"engine":{
					"name":"openEuler CSAF Tool V1.0"
				}
			},
			"current_release_date":"2024-10-31T09:46:53+08:00",
			"id":"openEuler-SA-2022-1977",
			"version":"2.0.0",
			"status":"final"
		}
	},
	"product_tree":{
		"branches":[
			{
				"name":"openEuler",
				"category":"vendor",
				"branches":[
					{
						"name":"openEuler",
						"branches":[
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:20.03-LTS-SP1"
									},
									"product_id":"openEuler-20.03-LTS-SP1",
									"name":"openEuler-20.03-LTS-SP1"
								},
								"name":"openEuler-20.03-LTS-SP1",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:20.03-LTS-SP3"
									},
									"product_id":"openEuler-20.03-LTS-SP3",
									"name":"openEuler-20.03-LTS-SP3"
								},
								"name":"openEuler-20.03-LTS-SP3",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:22.03-LTS"
									},
									"product_id":"openEuler-22.03-LTS",
									"name":"openEuler-22.03-LTS"
								},
								"name":"openEuler-22.03-LTS",
								"category":"product_version"
							}
						],
						"category":"product_name"
					},
					{
						"name":"noarch",
						"branches":[
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:20.03-LTS-SP1"
									},
									"product_id":"bcel-6.2-5.oe1.noarch.rpm(20.03-LTS-SP1)",
									"name":"bcel-6.2-5.oe1.noarch.rpm"
								},
								"name":"bcel-6.2-5.oe1.noarch.rpm",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:20.03-LTS-SP3"
									},
									"product_id":"bcel-6.2-5.oe1.noarch.rpm(20.03-LTS-SP3)",
									"name":"bcel-6.2-5.oe1.noarch.rpm"
								},
								"name":"bcel-6.2-5.oe1.noarch.rpm",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:22.03-LTS"
									},
									"product_id":"bcel-6.4.1-2.oe2203.noarch.rpm",
									"name":"bcel-6.4.1-2.oe2203.noarch.rpm"
								},
								"name":"bcel-6.4.1-2.oe2203.noarch.rpm",
								"category":"product_version"
							}
						],
						"category":"architecture"
					},
					{
						"name":"src",
						"branches":[
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:20.03-LTS-SP1"
									},
									"product_id":"bcel-6.2-5.oe1.src.rpm(20.03-LTS-SP1)",
									"name":"bcel-6.2-5.oe1.src.rpm"
								},
								"name":"bcel-6.2-5.oe1.src.rpm",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:20.03-LTS-SP3"
									},
									"product_id":"bcel-6.2-5.oe1.src.rpm(20.03-LTS-SP3)",
									"name":"bcel-6.2-5.oe1.src.rpm"
								},
								"name":"bcel-6.2-5.oe1.src.rpm",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:22.03-LTS"
									},
									"product_id":"bcel-6.4.1-2.oe2203.src.rpm",
									"name":"bcel-6.4.1-2.oe2203.src.rpm"
								},
								"name":"bcel-6.4.1-2.oe2203.src.rpm",
								"category":"product_version"
							}
						],
						"category":"architecture"
					}
				]
			}
		],
		"relationships":[
			{
				"relates_to_product_reference":"openEuler-20.03-LTS-SP1",
				"product_reference":"bcel-6.2-5.oe1.noarch.rpm(20.03-LTS-SP1)",
				"full_product_name":{
					"product_id":"openEuler-20.03-LTS-SP1:bcel-6.2-5.oe1.noarch",
					"name":"bcel-6.2-5.oe1.noarch as a component of openEuler-20.03-LTS-SP1"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-20.03-LTS-SP3",
				"product_reference":"bcel-6.2-5.oe1.noarch.rpm(20.03-LTS-SP3)",
				"full_product_name":{
					"product_id":"openEuler-20.03-LTS-SP3:bcel-6.2-5.oe1.noarch",
					"name":"bcel-6.2-5.oe1.noarch as a component of openEuler-20.03-LTS-SP3"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-22.03-LTS",
				"product_reference":"bcel-6.4.1-2.oe2203.noarch.rpm",
				"full_product_name":{
					"product_id":"openEuler-22.03-LTS:bcel-6.4.1-2.oe2203.noarch",
					"name":"bcel-6.4.1-2.oe2203.noarch as a component of openEuler-22.03-LTS"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-20.03-LTS-SP1",
				"product_reference":"bcel-6.2-5.oe1.src.rpm(20.03-LTS-SP1)",
				"full_product_name":{
					"product_id":"openEuler-20.03-LTS-SP1:bcel-6.2-5.oe1.src",
					"name":"bcel-6.2-5.oe1.src as a component of openEuler-20.03-LTS-SP1"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-20.03-LTS-SP3",
				"product_reference":"bcel-6.2-5.oe1.src.rpm(20.03-LTS-SP3)",
				"full_product_name":{
					"product_id":"openEuler-20.03-LTS-SP3:bcel-6.2-5.oe1.src",
					"name":"bcel-6.2-5.oe1.src as a component of openEuler-20.03-LTS-SP3"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-22.03-LTS",
				"product_reference":"bcel-6.4.1-2.oe2203.src.rpm",
				"full_product_name":{
					"product_id":"openEuler-22.03-LTS:bcel-6.4.1-2.oe2203.src",
					"name":"bcel-6.4.1-2.oe2203.src as a component of openEuler-22.03-LTS"
				},
				"category":"default_component_of"
			}
		]
	},
	"vulnerabilities":[
		{
			"cve":"CVE-2022-34169",
			"notes":[
				{
					"text":"The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. The Apache Xalan Java project is dormant and in the process of being retired. No future releases of Apache Xalan Java to address this issue are expected. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.",
					"category":"description",
					"title":"Vulnerability Description"
				}
			],
			"product_status":{
				"fixed":[
					"openEuler-20.03-LTS-SP1:bcel-6.2-5.oe1.noarch",
					"openEuler-20.03-LTS-SP3:bcel-6.2-5.oe1.noarch",
					"openEuler-22.03-LTS:bcel-6.4.1-2.oe2203.noarch",
					"openEuler-20.03-LTS-SP1:bcel-6.2-5.oe1.src",
					"openEuler-20.03-LTS-SP3:bcel-6.2-5.oe1.src",
					"openEuler-22.03-LTS:bcel-6.4.1-2.oe2203.src"
				]
			},
			"remediations":[
				{
					"product_ids":[
						"openEuler-20.03-LTS-SP1:bcel-6.2-5.oe1.noarch",
						"openEuler-20.03-LTS-SP3:bcel-6.2-5.oe1.noarch",
						"openEuler-22.03-LTS:bcel-6.4.1-2.oe2203.noarch",
						"openEuler-20.03-LTS-SP1:bcel-6.2-5.oe1.src",
						"openEuler-20.03-LTS-SP3:bcel-6.2-5.oe1.src",
						"openEuler-22.03-LTS:bcel-6.4.1-2.oe2203.src"
					],
					"details":"bcel security update",
					"category":"vendor_fix",
					"url":"https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2022-1977"
				}
			],
			"scores":[
				{
					"cvss_v3":{
						"baseSeverity":"HIGH",
						"baseScore":7.5,
						"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
						"version":"3.1"
					},
					"products":[
						"openEuler-20.03-LTS-SP1:bcel-6.2-5.oe1.noarch",
						"openEuler-20.03-LTS-SP3:bcel-6.2-5.oe1.noarch",
						"openEuler-22.03-LTS:bcel-6.4.1-2.oe2203.noarch",
						"openEuler-20.03-LTS-SP1:bcel-6.2-5.oe1.src",
						"openEuler-20.03-LTS-SP3:bcel-6.2-5.oe1.src",
						"openEuler-22.03-LTS:bcel-6.4.1-2.oe2203.src"
					]
				}
			],
			"threats":[
				{
					"details":"High",
					"category":"impact"
				}
			],
			"title":"CVE-2022-34169"
		}
	]
}