Batik Dependency Subject to Known Vulnerabilities

[syoon2]

graphviz-java/graphviz-java/pom.xml

Lines 92 to 104 in f0c1fdf

	<!-- Only needed for BATIK renderer -->
	<dependency>
	<groupId>org.apache.xmlgraphics</groupId>
	<artifactId>batik-rasterizer</artifactId>
	<version>1.14</version>
	<optional>true</optional>
	<exclusions>
	<exclusion>
	<groupId>commons-logging</groupId>
	<artifactId>commons-logging</artifactId>
	</exclusion>
	</exclusions>
	</dependency>

List of known vulnerabilities

Fixed in 1.15:

• CVE-2022-38648
• CVE-2022-40146

Fixed in 1.16:

• CVE-2022-41704
• CVE-2022-42890

Fixed in 1.17:

• CVE-2022-44729
• CVE-2022-44730

Issues Affecting This Repository

A simple dependency version bump works fine for 1.15 / 1.16. For 1.17, however, a simple version bump does not work as it breaks several Batik rasterizer tests, with the presumable cause being the patches for CVE-2022-44729.