CVE-2022-24816

OSGeo GeoServer JAI-EXT Code Injection Vulnerability

Jai-Ext

JAI-EXT is an open-source project which aims to extend the Java Advanced Imaging (JAI) API. Programs allowing Jiffle script to be provided via network request can lead to a Remote Code Execution as the Jiffle script is compiled into Java code via Janino, and executed. In particular, this affects the downstream GeoServer project. Version 1.2.22 will contain a patch that disables the ability to inject malicious code into the resulting script. Users unable to upgrade may negate…

13. Apr 2022

Ausgewertete Quellen

• CISA
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24816
• CISA
  OSGeo GeoServer JAI-EXT Code Injection Vulnerability
• NVD
  CVE-2022-24816
• GitHub
  https://github.com/geosolutions-it/jai-ext/security/advisories/GHSA-v92f-jx6p-73rx