CVE-2022-42920

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-42920
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-42920.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-42920
Aliases
Downstream
ALSA (1)
AZL (1)
CGA (6)
CLSA (3)
DEBIAN (1)
openSUSE (2)
RHSA (4)
RLSA (1)
SUSE (2)
UBUNTU (1)
Related
ALSA (1)
openSUSE (2)
SUSE (2)
Published
2022-11-07T00:00:00Z
Modified
2026-10-28T02:31:11Z
Summary
Apache Commons BCEL prior to 6.6.0 allows producing arbitrary bytecode via out-of-bounds writing
Details

Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds writing issue, these APIs can be used to produce arbitrary bytecode. This could be abused in applications that pass attacker-controllable data to those APIs, giving the attacker more control over the resulting bytecode than otherwise expected. Update to Apache Commons BCEL 6.6.0.

Database specific 
{
    "cna_assigner": "apache",
    "cwe_ids": [
        "CWE-787"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/42xxx/CVE-2022-42920.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "Apache Commons BCEL"
                        },
                        {
                            "fixed": "6.6.0"
                        }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/apache/commons-bcel

Affected ranges

Type
GIT
Repo
https://github.com/apache/commons-bcel
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
cf520ef45064c8fa4f43717ecc789d5a4f6b0d57
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:apache:commons_bcel:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "6.6.0"
                }
            ],
            "source": "CPE_RANGE"
        }
    ]
}

Affected versions

commons-bcel-6.*
commons-bcel-6.3.1
commons-bcel-6.3.1-RC1
commons-bcel-6.4.0-RC1
commons-bcel-6.4.0-RC2
commons-bcel-6.4.1-RC1
commons-bcel-6.5.0-RC1
commons-bcel-6.6.0-RC1
rel/commons-bcel-6.*
rel/commons-bcel-6.4.0
rel/commons-bcel-6.4.1
rel/commons-bcel-6.5.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-42920.json"