Apache Commons BCEL prior to 6.6.0 allows producing arbitrary bytecode via out-of-bounds writing
Priority MEDIUM 48CWE-787Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 15 fixed, 8 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-787 and the CVSS impact.
Summary
Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds writing issue, these APIs can be used to produce arbitrary bytecode. This could be abused in applications that pass attacker-controllable data to those APIs, giving the attacker more control over the resulting bytecode than otherwise expected. Update to Apache Commons BCEL 6.6.0.
Why it matters now
EPSS 0.03501 89th percentileScored 2026-11-07
Fix Partial Apache Commons BCEL (Apache Software Foundation): 6.6.0org.apache.bcel:bcel (Maven): 6.6.0Red Hat: 10 advisoriesRed Hat: 15 fixed, 8 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Commons BCEL | Apache Commons BCEL to before 6.6.0 | 6.6.0 | Patch available | CNA |
| — | org.apache.bcel:bcel (Maven) | before 6.6.0 | 6.6.0 | Patch available | GHSA-97xg-phpr-rg8q |
- Apache Commons BCEL VendorApache Affected Apache Commons BCEL to before 6.6.0 Fixed in 6.6.0 Patch available CNA
- org.apache.bcel:bcel (Maven) Vendor— Affected before 6.6.0 Fixed in 6.6.0 Patch available GHSA-97xg-phpr-rg8q
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:commons_bcel:*:*:*:*:*:*:*:* | before 6.6.0 | Vulnerable | Apache |
| cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* | 35 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* | 36 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* | 37 | Vulnerable | Fedoraproject |
- cpe:2.3:a:apache:commons_bcel:*:*:*:*:*:*:*:* Versions before 6.6.0 Vulnerable ·Apache
- cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* Versions 36 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* Versions 37 Vulnerable ·Fedoraproject
Remediation
- Fix · CNA Apache Commons BCEL (Apache Software Foundation) Fixed in 6.6.0
- Fix · GHSA-97xg-phpr-rg8q org.apache.bcel:bcel (Maven) Fixed in 6.6.0 Advisory →
Red Hat 10 advisories
- RHSA-2024:3527 Released 2024-05-30 · Red Hat rating ModerateRed Hat AMQ Streams 2.7.0 release and security update
- Red Hat AMQ Streams 2.7.0
- RHSA-2023:4983 Released 2023-09-05 · Red Hat rating ImportantRed Hat Process Automation Manager 7.13.4 security update
- RHPAM 7.13.4 async
- RHSA-2023:3954 Released 2023-06-29 · Red Hat rating CriticalRed Hat Fuse 7.12 release and security update
- Red Hat Fuse 7.12
Show 7 more Red Hat advisories
- RHSA-2023:0934 Released 2023-02-28 · Red Hat rating ImportantMigration Toolkit for Applications security and bug fix update
- MTA 6.0 for RHEL 8 mta/mta-admin-addon-rhel8, mta/mta-hub-rhel8, mta/mta-ui-rhel8 +1
- RHSA-2023:0470 Released 2023-01-26 · Red Hat rating ImportantMigration Toolkit for Runtimes security update
- Migration Toolkit for Runtimes 1 on RHEL 8 mtr/mtr-operator-bundle, mtr/mtr-rhel8-operator, mtr/mtr-web-container-rhel8 +1
- RHSA-2023:0471 Released 2023-01-26 · Red Hat rating ImportantMigration Toolkit for Runtimes security update
- Migration Toolkit for Runtimes 1 on RHEL 8
- RHSA-2023:0004 Released 2023-01-02 · Red Hat rating Importantbcel security update
- Red Hat Enterprise Linux AppStream EUS (v.9.0) bcel-6.4.1-9.el9_0
- RHSA-2023:0005 Released 2023-01-02 · Red Hat rating Importantbcel security update
- Red Hat Enterprise Linux AppStream (v. 9) bcel-6.4.1-9.el9_1
- RHSA-2022:8958 Released 2022-12-13 · Red Hat rating Importantbcel security update
- Red Hat Enterprise Linux Client Optional (v. 7) bcel-5.2-19.el7_9, bcel-javadoc-5.2-19.el7_9
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) bcel-5.2-19.el7_9, bcel-javadoc-5.2-19.el7_9
- Red Hat Enterprise Linux Server (v. 7) bcel-5.2-19.el7_9
- Red Hat Enterprise Linux Server Optional (v. 7) bcel-5.2-19.el7_9, bcel-javadoc-5.2-19.el7_9
- Red Hat Enterprise Linux Workstation (v. 7) bcel-5.2-19.el7_9
- Red Hat Enterprise Linux Workstation Optional (v. 7) bcel-javadoc-5.2-19.el7_9
- RHSA-2022:8959 Released 2022-12-13 · Red Hat rating Importantrh-maven36-bcel security update
- Red Hat Software Collections for RHEL Workstation(v. 7) rh-maven36-bcel-6.3.1-2.3.el7, rh-maven36-bcel-javadoc-6.3.1-2.3.el7
- Red Hat Software Collections for RHEL(v. 7) rh-maven36-bcel-6.3.1-2.3.el7, rh-maven36-bcel-javadoc-6.3.1-2.3.el7
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Migration Toolkit for Applications 6 | Affected | No fix yet |
| Migration Toolkit for Runtimes | Affected | No fix yet |
| Red Hat JBoss Data Grid 7 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform 7 | Affected | No fix yet |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Out of support scope |
| Red Hat Single Sign-On 7 | Affected | No fix yet |
| MTA 6.0 for RHEL 8 | Fixed | RHSA-2023:0934 |
| Migration Toolkit for Runtimes 1 on RHEL 8 | Fixed | RHSA-2023:0470, RHSA-2023:0471 |
| RHPAM 7.13.4 async | Fixed | RHSA-2023:4983 |
| Red Hat AMQ Streams 2.7.0 | Fixed | RHSA-2024:3527 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2023:0005 |
| Red Hat Enterprise Linux AppStream EUS (v.9.0) | Fixed | RHSA-2023:0004 |
| Red Hat Enterprise Linux Client Optional (v. 7) | Fixed | RHSA-2022:8958 |
| Red Hat Enterprise Linux ComputeNode Optional (v. 7) | Fixed | RHSA-2022:8958 |
| Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2022:8958 |
| Red Hat Enterprise Linux Server Optional (v. 7) | Fixed | RHSA-2022:8958 |
| Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2022:8958 |
| Red Hat Enterprise Linux Workstation Optional (v. 7) | Fixed | RHSA-2022:8958 |
| Red Hat Fuse 7.12 | Fixed | RHSA-2023:3954 |
| Red Hat Software Collections for RHEL Workstation(v. 7) | Fixed | RHSA-2022:8959 |
| Red Hat Software Collections for RHEL(v. 7) | Fixed | RHSA-2022:8959 |
Not affected: 4 products
- MTA 6.0 for RHEL 8
- Red Hat Data Grid 8
- Red Hat Integration Camel K 1
- Red Hat JBoss Enterprise Application Platform Expansion Pack
Timeline
- 2026-10-02 Threatist record created from CVE-2022-42920
- 2026-10-03 Alias added: GHSA-97xg-phpr-rg8q
References
Advisory 7
- https://lists.apache.org/thread/lfxk7q8qmnh5bt9jm6nmjlv5hsxjhrz4
- [oss-security] 20221107 Re: CVE-2022-42920: Apache Commons BCEL prior to 6.6.0 allows producing arbitrary bytecode via out-of-bounds writing
- FEDORA-2022-01a56f581c
- FEDORA-2022-0e358addb8
- FEDORA-2022-f60a52e054
- GLSA-202401-25
- https://nvd.nist.gov/vuln/detail/CVE-2022-42920
Other 9
- https://github.com/apache/commons-bcel/pull/147
- https://github.com/apache/commons-bcel
- https://issues.apache.org/jira/browse/BCEL-363
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LX3HEB4TV2BVCGDTK5BCLSYOZNQTOBN4
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QAMRHAKGIKZNHRBB4VLYTOIOIMMXCUCD
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QMVX6COVXZVS5GPWDODIRW6Z2GE7RPAQ
- https://lists.fedoraproject.org/archives/list/[email protected]/message/LX3HEB4TV2BVCGDTK5BCLSYOZNQTOBN4
- https://lists.fedoraproject.org/archives/list/[email protected]/message/QAMRHAKGIKZNHRBB4VLYTOIOIMMXCUCD
- https://lists.fedoraproject.org/archives/list/[email protected]/message/QMVX6COVXZVS5GPWDODIRW6Z2GE7RPAQ
Sources
- CVE-2022-42920 · CVE Program
- CVE-2022-42920 · NVD
- FIRST EPSS
- GHSA-97xg-phpr-rg8q · GitHub Advisory Database · CC BY 4.0
- CVE-2022-42920 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences