CVE-2022-44729

Name	CVE-2022-44729
Description	Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. On version 1.16, a malicious SVG could trigger loading external resources by default, causing resource consumption or in some cases even information disclosure. Users are recommended to upgrade to version 1.17 or later.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-3619-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
batik (PTS)	buster	1.10-2+deb10u1	vulnerable
	buster (security)	1.10-2+deb10u3	fixed
	bullseye	1.12-4+deb11u2	fixed
	bullseye (security)	1.12-4+deb11u1	vulnerable
	bookworm	1.16+dfsg-1+deb12u1	fixed
	sid, trixie	1.17+dfsg-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
batik	source	buster	1.10-2+deb10u3	DLA-3619-1
batik	source	bullseye	1.12-4+deb11u2
batik	source	bookworm	1.16+dfsg-1+deb12u1
batik	source	(unstable)	1.17+dfsg-1

https://www.openwall.com/lists/oss-security/2023/08/22/2
https://issues.apache.org/jira/browse/BATIK-1349