WaratekVRT Sign in

CVE-2022-42920 Apache Commons BCEL

Affected softwareApache Commons BCEL
Severity9.8 Critical CVSS 3.1
Fixed in6.6.0
WeaknessOut-of-bounds write (CWE-787)
Published7 Nov 2022
Updated17 Jun 2026

Description

Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds writing issue, these APIs can be used to produce arbitrary bytecode. This could be abused in applications that pass attacker-controllable data to those APIs, giving the attacker more control over the resulting bytecode than otherwise expected. Update to Apache Commons BCEL 6.6.0.

Exploitation status

No public exploit

No exploit has been reported in the sources we check. Published 4 years ago.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment no assessment published
  • Indexed PoC none indexed
  • EPSS 3.5% chance in 30 days

Waratek protection

Protected by Waratek

Waratek has a rule that blocks attacks on this vulnerability.

  • Protection full
  • Action available patch rule
  • Review human ARMR file
  • Record active
Decided by An ARMR patch file on disk for this CVE
Finding CVE has an ARMR patch rule that provides mitigation

ARMR rule files

1 file

The rule files Waratek ships for this CVE. Some CVEs need more than one, for example one per affected library or one per ARMR version.

CVE-2022-42920.armr patch rule, ARMR 2.6 added 2023-02-23 updated 2026-03-04
Sign in to download

How to mitigate CVE-2022-42920

Upgrade Apache Commons BCEL to 6.6.0 or later. Until you can, Waratek RASP blocks exploitation with a rule written for this CVE. It runs inside the Java application, with no code changes.

Waratek RASP Runtime protection for Java applications

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update April 2024 ↗ CPU 2024-Q2 Oracle Enterprise Manager / Enterprise Manager Install (Apache Commons BCEL) (13.5.0.0)
Oracle Enterprise Manager / Load Testing for Web Apps (Apache Commons BCEL) (13.3.0.1)
Oracle Retail Applications / Application Core (Apache Commons BCEL) (15.0.3, 16.0.3)
Oracle Systems / Core (Apache Commons BCEL) (2.5)
Oracle Systems / Tools (Apache Commons BCEL) (4)
Oracle Critical Patch Update January 2024 ↗ CPU 2024-Q1 Oracle Communications Applications / Order and Service Management (Apache Commons BCEL) (7.4.0.7.0, 7.4.1.5.0, 7.4.2.8.0)
Oracle Financial Services Applications / Application (Apache Xalan-Java) (8.0.8.1, 8.1.1.1, 8.1.2.5, 8.1.2.6)
Oracle Retail Applications / Operations and Maintenance (Apache Commons BCEL) (15.0.3, 16.0.3)
Oracle Critical Patch Update October 2023 ↗ CPU 2023-Q4 Oracle Communications / CMP (Apache Commons BCEL) (12.6.0.0)
Oracle Communications Applications / General (Apache Commons BCEL) (7.4.0, 7.4.1)
Oracle Communications Applications / Print Preview (Apache Commons BCEL) (6.3.1.0.0)
Oracle Fusion Middleware / Core (Apache Commons BCEL) (12.2.1.4.0, 14.1.1.0.0)
Oracle Fusion Middleware / Discussion Forums (Apache Commons BCEL) (12.2.1.4.0)
Oracle Fusion Middleware / General (Apache Commons BCEL) (12.2.1.4.0)
Oracle Insurance Applications / Development Tools (Apache Commons BCEL) (12.6.4-12.7.1)
Oracle PeopleSoft / XML CHE (Apache Commons BCEL) (9.2)
Oracle Retail Applications / BDI Job Scheduler (Apache Commons BCEL) (16.0.3, 19.0.1)
Oracle Retail Applications / Foundation (Apache Commons BCEL) (19.0.1)
Oracle Retail Applications / Installation (Apache Commons BCEL) (14.1.3.2, 15.0.3.1, 16.0.3, 19.0.1)
Oracle Retail Applications / PeopleSoft Integration Bugs (Apache Commons BCEL) (14.1.3.2, 15.0.3.1, 16.0.3, 19.0.1)
Oracle Retail Applications / RIB (Apache Commons BCEL) (14.1.3.2, 15.0.3.1, 16.0.3, 19.0.1)
Oracle Utilities Applications / General (Apache Commons BCEL) (4.2.0.3.0, 4.3.0.1.0-4.3.0.6.0, 4.4.0.0.0, 4.4.0.2.0)
Oracle Critical Patch Update July 2023 ↗ CPU 2023-Q3 Oracle Fusion Middleware / General (Apache Commons BCEL) (12.2.1.4.0)
Oracle Critical Patch Update January 2023 ↗ CPU 2023-Q1 Oracle Fusion Middleware / Centralized Third party Jars (Apache Commons BCEL) (12.2.1.3.0, 12.2.1.4.0)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Communications CMP (Apache Commons BCEL) 12.6.0.0 12.6.0.0
Oracle Communications Applications General (Apache Commons BCEL) 7.4.0, 7.4.1 7.4.0 · 7.4.1
Oracle Communications Applications Order and Service Management (Apache Commons BCEL) 7.4.0.7.0, 7.4.1.5.0, 7.4.2.8.0 7.4.0.7.0 · 7.4.1.5.0 · 7.4.2.8.0
Oracle Communications Applications Print Preview (Apache Commons BCEL) 6.3.1.0.0 6.3.1.0.0
Oracle Enterprise Manager Enterprise Manager Install (Apache Commons BCEL) 13.5.0.0 13.5.0.0
Oracle Enterprise Manager Load Testing for Web Apps (Apache Commons BCEL) 13.3.0.1 13.3.0.1
Oracle Financial Services Applications Application (Apache Xalan-Java) 8.0.8.1, 8.1.1.1, 8.1.2.5, 8.1.2.6 8.0.8.1 · 8.1.1.1 · 8.1.2.5 · 8.1.2.6
Oracle Fusion Middleware Centralized Third party Jars (Apache Commons BCEL) 12.2.1.3.0, 12.2.1.4.0 12.2.1.3.0 · 12.2.1.4.0
Oracle Fusion Middleware Core (Apache Commons BCEL) 12.2.1.4.0, 14.1.1.0.0 12.2.1.4.0 · 14.1.1.0.0
Oracle Fusion Middleware Discussion Forums (Apache Commons BCEL) 12.2.1.4.0 12.2.1.4.0
Oracle Fusion Middleware General (Apache Commons BCEL) 12.2.1.4.0 12.2.1.4.0
Oracle Insurance Applications Development Tools (Apache Commons BCEL) 12.6.4-12.7.1
Oracle PeopleSoft XML CHE (Apache Commons BCEL) 9.2 9.2
Oracle Retail Applications Application Core (Apache Commons BCEL) 15.0.3, 16.0.3 15.0.3 · 16.0.3
Oracle Retail Applications BDI Job Scheduler (Apache Commons BCEL) 16.0.3, 19.0.1 16.0.3 · 19.0.1
Oracle Retail Applications Foundation (Apache Commons BCEL) 19.0.1 19.0.1
Oracle Retail Applications Installation (Apache Commons BCEL) 14.1.3.2, 15.0.3.1, 16.0.3, 19.0.1 14.1.3.2 · 15.0.3.1 · 16.0.3 · 19.0.1
Oracle Retail Applications Operations and Maintenance (Apache Commons BCEL) 15.0.3, 16.0.3 15.0.3 · 16.0.3
Oracle Retail Applications PeopleSoft Integration Bugs (Apache Commons BCEL) 14.1.3.2, 15.0.3.1, 16.0.3, 19.0.1 14.1.3.2 · 15.0.3.1 · 16.0.3 · 19.0.1
Oracle Retail Applications RIB (Apache Commons BCEL) 14.1.3.2, 15.0.3.1, 16.0.3, 19.0.1 14.1.3.2 · 15.0.3.1 · 16.0.3 · 19.0.1
Oracle Systems Core (Apache Commons BCEL) 2.5 2.5
Oracle Systems Tools (Apache Commons BCEL) 4 4
Oracle Utilities Applications General (Apache Commons BCEL) 4.2.0.3.0, 4.3.0.1.0-4.3.0.6.0, 4.4.0.0.0, 4.4.0.2.0 4.2.0.3.0 · 4.4.0.0.0 · 4.4.0.2.0

Maven packages

Affected and fixed versions, from OSV.dev
PackageIntroducedFixedLast affected
org.apache.bcel:bcel 0 6.6.0 unbounded

Products and versions

3 products, 5 version entries
SourceVendorProductSchemeAffected versions
nvd apache commons bcel generic ＜ 6.6.0
nvd fedoraproject fedora generic 35 · 36 · 37
osv org.apache.bcel bcel generic ＜ 6.6.0

References

URLTags
https://github.com/apache/commons-bcel/pull/147 WEB
https://github.com/apache/commons-bcel PACKAGE
https://issues.apache.org/jira/browse/BCEL-363 WEB
https://lists.apache.org/thread/lfxk7q8qmnh5bt9jm6nmjlv5hsxjhrz4 WEB
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LX3HEB4TV2BVCGDTK5BCLSYOZNQTOBN4 WEB
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QAMRHAKGIKZNHRBB4VLYTOIOIMMXCUCD WEB
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QMVX6COVXZVS5GPWDODIRW6Z2GE7RPAQ WEB
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LX3HEB4TV2BVCGDTK5BCLSYOZNQTOBN4 WEB
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QAMRHAKGIKZNHRBB4VLYTOIOIMMXCUCD WEB
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QMVX6COVXZVS5GPWDODIRW6Z2GE7RPAQ WEB

Timeline
Published2022-11-07By the CVE Program.
ARMR remediation created2023-02-23Earliest commit adding this CVE's ARMR patch or security rule.
ARMR remediation last updated2026-03-04Most recent commit touching this CVE's ARMR patch or security rule.
Last VRT activity2026-03-04Most recent commit touching this CVE's classification, patch or rule file.
NVD record modified2026-06-17NVD's own last-modified date for this record.