CVE-2022-42920

Name of the Vulnerable Software and Affected Versions Apache Commons BCEL versions prior to 6.6.0

Description The issue is related to an out-of-bounds writing problem in Apache Commons BCEL, which can be exploited to produce arbitrary bytecode. This could be abused in applications that pass attacker-controllable data to the affected APIs, giving the attacker more control over the resulting bytecode than otherwise expected.

Recommendations Update to Apache Commons BCEL 6.6.0 to resolve the issue. As a temporary workaround, consider restricting the use of APIs that allow changing specific class characteristics to minimize the risk of exploitation. Avoid passing attacker-controllable data to these APIs until the issue is resolved.