Homepage
About Snyk

org.apache.commons:commons-configuration2@2.4 vulnerabilities

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the org.apache.commons:commons-configuration2 package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • H
Out-of-Bounds Write

org.apache.commons:commons-configuration2 is a group of tools to assist in the reading of configuration/preferences files in various formats.

Affected versions of this package are vulnerable to Out-of-Bounds Write due to the improper handling of certain configurations in the AbstractListDelimiterHandler.flattenIterator method. An attacker can trigger a stack overflow by submitting a crafted configuration file or input, leading to a denial of service condition.

How to fix Out-of-Bounds Write?

Upgrade org.apache.commons:commons-configuration2 to version 2.10.1 or higher.

[2.0.0,2.10.1)
  • H
Out-of-Bounds Write

org.apache.commons:commons-configuration2 is a group of tools to assist in the reading of configuration/preferences files in various formats.

Affected versions of this package are vulnerable to Out-of-Bounds Write due to the improper handling of a cyclical object tree when calling the ListDelimiterHandler.flatten method. An attacker can trigger a StackOverflowError and potentially cause a denial of service condition by submitting a specially crafted configuration object.

How to fix Out-of-Bounds Write?

Upgrade org.apache.commons:commons-configuration2 to version 2.10.1 or higher.

[2.0.0,2.10.1)
  • H
Arbitrary Code Execution

org.apache.commons:commons-configuration2 is a group of tools to assist in the reading of configuration/preferences files in various formats.

Affected versions of this package are vulnerable to Arbitrary Code Execution via the Lookup functionality due to the ability to use certain insecure lookups that perform interpolation.

These lookups are:

  1. script execute expressions using the JVM script execution engine (javax.script).

  2. dns resolve DNS records.

  3. url load values from URLs, including from remote servers.

CVSS Score Explanation:

This module is designed for secure configuration management. This implies that the files it handles should have limited access, whether local or remote. Remote attacks require basic privileges and server setup for remote commands. This aligns with AC:H and PR:L

How to fix Arbitrary Code Execution?

Upgrade org.apache.commons:commons-configuration2 to version 2.8 or higher.

[2.4,2.8)
  • H
Remote Code Execution (RCE)

org.apache.commons:commons-configuration2 is a group of tools to assist in the reading of configuration/preferences files in various formats.

Affected versions of this package are vulnerable to Remote Code Execution (RCE). It uses a third-party library to parse YAML files (org.yaml:snakeyaml) which by default allows the instantiation of classes if the YAML includes special statements. Apache Commons Configuration did not change the default settings of this library. Therefore if a YAML file was loaded from an untrusted source, it could therefore load and execute code out of the control of the host application.

How to fix Remote Code Execution (RCE)?

Upgrade org.apache.commons:commons-configuration2 to version 2.7 or higher.

[2.2,2.7)
Go back to all versions of this package