Centos 7 CVE-2022-42920 missing security update

Hans Blaauw

1/16/24, 1:00 PM

Since a couple of months we are using a vulnerability scanner (Rapid 7) which is complaining about the bcel package being vulnerable. Red Hat released an update package, but hasn't found it's way to the Centos 7 repository. The only suggestion so far I can find is update to the latest version of bcel in the Centos repository, which ain't helpful as the latest version seems vulnerable. Also I can't find a rpm to install manually.

The info I found at Red Hat: https://access.redhat.com/security/cve/cve-2022-42920

Currently installed:

Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
 * base: mirror.nforce.com
 * epel: ftp.nluug.nl
 * extras: centos.mirror.transip.nl
 * updates: centos.mirror.transip.nl
Installed Packages
Name        : bcel
Arch        : noarch
Version     : 5.2
Release     : 18.el7
Size        : 525 k
Repo        : installed
From repo   : base
Summary     : Byte Code Engineering Library
URL         : http://commons.apache.org/proper/commons-bcel/
License     : ASL 2.0
Description : The Byte Code Engineering Library (formerly known as JavaClass) is
            : intended to give users a convenient possibility to analyze, create, and
            : manipulate (binary) Java class files (those ending with .class). Classes
            : are represented by objects which contain all the symbolic information of
            : the given class: methods, fields and byte code instructions, in
            : particular.  Such objects can be read from an existing file, be
            : transformed by a program (e.g. a class loader at run-time) and dumped to
            : a file again. An even more interesting application is the creation of
            : classes from scratch at run-time. The Byte Code Engineering Library
            : (BCEL) may be also useful if you want to learn about the Java Virtual
            : Machine (JVM) and the format of Java .class files.  BCEL is already
            : being used successfully in several projects such as compilers,
            : optimizers, obsfuscators and analysis tools, the most popular probably
            : being the Xalan XSLT processor at Apache.

Anybody has a suggestion how to deal with such situations? This seems to happen more often then I realized.

279

0 + 3

linux

package-management

centos

yum

Andrew Henle

1/16/24, 1:39 PM

*Anybody has a suggestion how to deal with such situations?* You have two options: wait for a Centos patch, or add "maintain OS distribution" to your job description. Do you have the time and resources necessary to go into the OS distribution business? Because once you start doing things like manually installing updates to OS-distribution-supplied components from outside the distribution, you've *de facto* forked the OS distribution into a custom one. Are you going to regression test all your OS builds? Are you going to watch CVE lists for vulnerabilities you have to fix immediately?

Hans Blaauw

1/16/24, 2:00 PM

Interesting solution, will update my linkedin profile lol. But thanks, I was just wondering if people were dealing with the same issue. Since some issues can be risky, my boss gets nervous. But ok, I will just keep it to myself and silently update when a patch is available.

Andrew Henle

1/16/24, 2:11 PM

[You're lucky in this case](https://nvd.nist.gov/vuln/detail/CVE-2022-42920): "**Undergoing Reanalysis** This vulnerability has been modified and is currently undergoing reanalysis. Please check back soon to view the updated vulnerability summary." That's probably why there isn't a Centos patch for this yet.

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Centos 7 CVE-2022-42920 missing security update

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.