CVE catalog

CVE-2022-4065

testng: CVE-2022-4065

[CVE catalog]

Severity
High · CVSS 8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.97% · Oct 25, 2026

A vulnerability was found in cbeust testng 7.5.0/7.6.0/7.6.1/7.7.0. It has been declared as critical. Affected by this vulnerability is the function testngXmlExistsInJar of the file testng-core/src/main/java/org/testng/JarFileUtils.java of the component XML File Parser. The manipulation leads to path traversal. The attack can be launched remotely. Upgrading to version 7.5.1 and 7.7.1 is able to address this issue. The patch is named 9150736cd2c123a6a3b60e6193630859f9f0422b. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-214027.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiantestngsid6.9.12-5not affected
Debiantestngforky6.9.12-5not affected
Debiantestngtrixie6.9.12-4not affected
Debiantestngbookworm6.9.12-4not affected
Susesnakeyamllinux enterprise module for development tools 15 sp52.2-150200.3.15.1fixed
Susetestnglinux enterprise module for development tools 15 sp57.10.1-150200.3.10.1fixed
Susesnakeyamllinux enterprise module for development tools 15 sp62.2-150200.3.15.1fixed
Susetestnglinux enterprise module for development tools 15 sp67.10.1-150200.3.10.1fixed
Susemockitolinux enterprise module for package hub 15 sp65.11.0-150200.3.7.1fixed
Susesnakeyamlmanager server module 4.32.2-150200.3.15.1fixed
Susesnakeyamllinux enterprise high performance computing 15 sp2-ltss2.2-150200.3.15.1fixed
Susetestnglinux enterprise high performance computing 15 sp2-ltss7.10.1-150200.3.10.1fixed
Susesnakeyamllinux enterprise high performance computing 15 sp3-ltss2.2-150200.3.15.1fixed
Susetestnglinux enterprise high performance computing 15 sp3-ltss7.10.1-150200.3.10.1fixed
Susesnakeyamllinux enterprise high performance computing 15 sp4-espos2.2-150200.3.15.1fixed
Susetestnglinux enterprise high performance computing 15 sp4-espos7.10.1-150200.3.10.1fixed
Susesnakeyamllinux enterprise high performance computing 15 sp4-ltss2.2-150200.3.15.1fixed
Susetestnglinux enterprise high performance computing 15 sp4-ltss7.10.1-150200.3.10.1fixed
Susesnakeyamllinux enterprise server 15 sp2-ltss2.2-150200.3.15.1fixed
Susetestnglinux enterprise server 15 sp2-ltss7.10.1-150200.3.10.1fixed
Susesnakeyamllinux enterprise server 15 sp3-ltss2.2-150200.3.15.1fixed
Susetestnglinux enterprise server 15 sp3-ltss7.10.1-150200.3.10.1fixed
Susesnakeyamllinux enterprise server 15 sp4-ltss2.2-150200.3.15.1fixed
Susetestnglinux enterprise server 15 sp4-ltss7.10.1-150200.3.10.1fixed
Susesnakeyamllinux enterprise server for sap applications 15 sp22.2-150200.3.15.1fixed
Susetestnglinux enterprise server for sap applications 15 sp27.10.1-150200.3.10.1fixed
Susesnakeyamllinux enterprise server for sap applications 15 sp32.2-150200.3.15.1fixed
Susetestnglinux enterprise server for sap applications 15 sp37.10.1-150200.3.10.1fixed
Susesnakeyamllinux enterprise server for sap applications 15 sp42.2-150200.3.15.1fixed
Susetestnglinux enterprise server for sap applications 15 sp47.10.1-150200.3.10.1fixed
Susesnakeyamlenterprise storage 7.12.2-150200.3.15.1fixed
Susetestngenterprise storage 7.17.10.1-150200.3.10.1fixed
Opensusemockitoleap 15.55.11.0-150200.3.7.1fixed
Opensusesnakeyamlleap 15.52.2-150200.3.15.1fixed
Opensusetestngleap 15.57.10.1-150200.3.10.1fixed
Opensusemockitoleap 15.65.11.0-150200.3.7.1fixed
Opensusesnakeyamlleap 15.62.2-150200.3.15.1fixed
Opensusetestngleap 15.67.10.1-150200.3.10.1fixed
Susetestnglinux enterprise module for development tools 15 sp47.4.0-150200.3.7.1fixed
Susetestnglinux enterprise high performance computing 15 sp2-ltss7.4.0-150200.3.7.1fixed
Susetestnglinux enterprise high performance computing 15 sp3-espos7.4.0-150200.3.7.1fixed
Susetestnglinux enterprise high performance computing 15 sp3-ltss7.4.0-150200.3.7.1fixed
Susetestnglinux enterprise real time 15 sp37.4.0-150200.3.7.1fixed
Susetestnglinux enterprise server 15 sp2-ltss7.4.0-150200.3.7.1fixed
Susetestnglinux enterprise server 15 sp3-ltss7.4.0-150200.3.7.1fixed
Susetestnglinux enterprise server for sap applications 15 sp27.4.0-150200.3.7.1fixed
Susetestnglinux enterprise server for sap applications 15 sp37.4.0-150200.3.7.1fixed
Susetestngenterprise storage 77.4.0-150200.3.7.1fixed
Susetestngenterprise storage 7.17.4.0-150200.3.7.1fixed
Opensusetestngleap 15.47.4.0-150200.3.7.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
DebiantestngsourcesidNot affectedunimportantNot reportedNot reported
DebiantestngsourceforkyNot affectedunimportantNot reportedNot reported
DebiantestngsourcetrixieNot affectedunimportantNot reportedNot reported
DebiantestngsourcebookwormNot affectedunimportantNot reportedNot reported
Susesnakeyamlrpmlinux enterprise module for development tools 15 sp52.2-150200.3.15.1Not reportedSUSE-SU-2024:2568-1Not reported
Susetestngrpmlinux enterprise module for development tools 15 sp57.10.1-150200.3.10.1Not reportedSUSE-SU-2024:2568-1Not reported
Susesnakeyamlrpmlinux enterprise module for development tools 15 sp62.2-150200.3.15.1Not reportedSUSE-SU-2024:2568-1Not reported
Susetestngrpmlinux enterprise module for development tools 15 sp67.10.1-150200.3.10.1Not reportedSUSE-SU-2024:2568-1Not reported
Susemockitorpmlinux enterprise module for package hub 15 sp65.11.0-150200.3.7.1Not reportedSUSE-SU-2024:2568-1Not reported
Susesnakeyamlrpmmanager server module 4.32.2-150200.3.15.1Not reportedSUSE-SU-2024:2568-1Not reported
Susesnakeyamlrpmlinux enterprise high performance computing 15 sp2-ltss2.2-150200.3.15.1Not reportedSUSE-SU-2024:2568-1Not reported
Susetestngrpmlinux enterprise high performance computing 15 sp2-ltss7.10.1-150200.3.10.1Not reportedSUSE-SU-2024:2568-1Not reported
Susesnakeyamlrpmlinux enterprise high performance computing 15 sp3-ltss2.2-150200.3.15.1Not reportedSUSE-SU-2024:2568-1Not reported
Susetestngrpmlinux enterprise high performance computing 15 sp3-ltss7.10.1-150200.3.10.1Not reportedSUSE-SU-2024:2568-1Not reported
Susesnakeyamlrpmlinux enterprise high performance computing 15 sp4-espos2.2-150200.3.15.1Not reportedSUSE-SU-2024:2568-1Not reported
Susetestngrpmlinux enterprise high performance computing 15 sp4-espos7.10.1-150200.3.10.1Not reportedSUSE-SU-2024:2568-1Not reported
Susesnakeyamlrpmlinux enterprise high performance computing 15 sp4-ltss2.2-150200.3.15.1Not reportedSUSE-SU-2024:2568-1Not reported
Susetestngrpmlinux enterprise high performance computing 15 sp4-ltss7.10.1-150200.3.10.1Not reportedSUSE-SU-2024:2568-1Not reported
Susesnakeyamlrpmlinux enterprise server 15 sp2-ltss2.2-150200.3.15.1Not reportedSUSE-SU-2024:2568-1Not reported
Susetestngrpmlinux enterprise server 15 sp2-ltss7.10.1-150200.3.10.1Not reportedSUSE-SU-2024:2568-1Not reported
Susesnakeyamlrpmlinux enterprise server 15 sp3-ltss2.2-150200.3.15.1Not reportedSUSE-SU-2024:2568-1Not reported
Susetestngrpmlinux enterprise server 15 sp3-ltss7.10.1-150200.3.10.1Not reportedSUSE-SU-2024:2568-1Not reported
Susesnakeyamlrpmlinux enterprise server 15 sp4-ltss2.2-150200.3.15.1Not reportedSUSE-SU-2024:2568-1Not reported
Susetestngrpmlinux enterprise server 15 sp4-ltss7.10.1-150200.3.10.1Not reportedSUSE-SU-2024:2568-1Not reported
Susesnakeyamlrpmlinux enterprise server for sap applications 15 sp22.2-150200.3.15.1Not reportedSUSE-SU-2024:2568-1Not reported
Susetestngrpmlinux enterprise server for sap applications 15 sp27.10.1-150200.3.10.1Not reportedSUSE-SU-2024:2568-1Not reported
Susesnakeyamlrpmlinux enterprise server for sap applications 15 sp32.2-150200.3.15.1Not reportedSUSE-SU-2024:2568-1Not reported
Susetestngrpmlinux enterprise server for sap applications 15 sp37.10.1-150200.3.10.1Not reportedSUSE-SU-2024:2568-1Not reported
Susesnakeyamlrpmlinux enterprise server for sap applications 15 sp42.2-150200.3.15.1Not reportedSUSE-SU-2024:2568-1Not reported
Susetestngrpmlinux enterprise server for sap applications 15 sp47.10.1-150200.3.10.1Not reportedSUSE-SU-2024:2568-1Not reported
Susesnakeyamlrpmenterprise storage 7.12.2-150200.3.15.1Not reportedSUSE-SU-2024:2568-1Not reported
Susetestngrpmenterprise storage 7.17.10.1-150200.3.10.1Not reportedSUSE-SU-2024:2568-1Not reported
Opensusemockitorpmleap 15.55.11.0-150200.3.7.1Not reportedSUSE-SU-2024:2568-1Not reported
Opensusesnakeyamlrpmleap 15.52.2-150200.3.15.1Not reportedSUSE-SU-2024:2568-1Not reported
Opensusetestngrpmleap 15.57.10.1-150200.3.10.1Not reportedSUSE-SU-2024:2568-1Not reported
Opensusemockitorpmleap 15.65.11.0-150200.3.7.1Not reportedSUSE-SU-2024:2568-1Not reported
Opensusesnakeyamlrpmleap 15.62.2-150200.3.15.1Not reportedSUSE-SU-2024:2568-1Not reported
Opensusetestngrpmleap 15.67.10.1-150200.3.10.1Not reportedSUSE-SU-2024:2568-1Not reported
Susetestngrpmlinux enterprise module for development tools 15 sp47.4.0-150200.3.7.1Not reportedSUSE-SU-2023:1690-1Not reported
Susetestngrpmlinux enterprise high performance computing 15 sp2-ltss7.4.0-150200.3.7.1Not reportedSUSE-SU-2023:1690-1Not reported
Susetestngrpmlinux enterprise high performance computing 15 sp3-espos7.4.0-150200.3.7.1Not reportedSUSE-SU-2023:1690-1Not reported
Susetestngrpmlinux enterprise high performance computing 15 sp3-ltss7.4.0-150200.3.7.1Not reportedSUSE-SU-2023:1690-1Not reported
Susetestngrpmlinux enterprise real time 15 sp37.4.0-150200.3.7.1Not reportedSUSE-SU-2023:1690-1Not reported
Susetestngrpmlinux enterprise server 15 sp2-ltss7.4.0-150200.3.7.1Not reportedSUSE-SU-2023:1690-1Not reported
Susetestngrpmlinux enterprise server 15 sp3-ltss7.4.0-150200.3.7.1Not reportedSUSE-SU-2023:1690-1Not reported
Susetestngrpmlinux enterprise server for sap applications 15 sp27.4.0-150200.3.7.1Not reportedSUSE-SU-2023:1690-1Not reported
Susetestngrpmlinux enterprise server for sap applications 15 sp37.4.0-150200.3.7.1Not reportedSUSE-SU-2023:1690-1Not reported
Susetestngrpmenterprise storage 77.4.0-150200.3.7.1Not reportedSUSE-SU-2023:1690-1Not reported
Susetestngrpmenterprise storage 7.17.4.0-150200.3.7.1Not reportedSUSE-SU-2023:1690-1Not reported
Opensusetestngrpmleap 15.47.4.0-150200.3.7.1Not reportedSUSE-SU-2023:1690-1Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [testng]Not affected
    Details (2)

    • 6.9.12-4 · all · bookworm

      Not affected

      dsa · testng · debian · bookworm

    • 6.9.12-4 · all · bookworm

      Not affected

      dsa · testng · debian · bookworm

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]