Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.
← back | CVE Intelligence

CVE-2022-34169

Curated 1 security research writeups, vulnerability advisories and exploitation analyses for CVE-2022-34169.

Coverage Span
2022-11-02
Reports
1 related reports

Associated Reports & Timeline

1.
[CVE-2022-34169] Gregor Samsa: Exploiting Java's XML Signature Verification
projectzero.google | vulnerability | | original ↗ | #exploit | #vulnerability | #security-research
Earlier this year, I discovered a surprising attack surface hidden deep inside Java’s standard library: A custom JIT compiler processing untrusted XSLT programs, exposed to remote attackers during XML signature verification. This post discusses CVE-2022-34169, an integer truncation bug in this JIT compiler resulting in arbitrary code execution in many Java-based web applications and identity providers that support the SAML single-sign-on standard.