CVE-2024-47554

Опубликовано: 03 окт. 2024

Источник: nvd

CVSS3: 4.3

EPSS Низкий

Описание

Uncontrolled Resource Consumption vulnerability in Apache Commons IO.

The org.apache.commons.io.input.XmlStreamReader class may excessively consume CPU resources when processing maliciously crafted input.

This issue affects Apache Commons IO: from 2.0 before 2.14.0.

Users are recommended to upgrade to version 2.14.0 or later, which fixes the issue.

Ссылки

https://lists.apache.org/thread/6ozr91rr9cj5lm0zyhv30bsp317hk5z1
Mailing List
Vendor Advisory
http://www.openwall.com/lists/oss-security/2024/10/03/2
Mailing List
Third Party Advisory
https://security.netapp.com/advisory/ntap-20250131-0010/
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:apache:commons_io:*:*:*:*:*:*:*:*

Версия от 2.0 (включая) до 2.14.0 (исключая)

Конфигурация 2

Одно из

cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*

cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*

cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*

cpe:2.3:a:netapp:bluexp:-:*:*:*:*:*:*:*

cpe:2.3:a:netapp:e-series_santricity_unified_manager:-:*:*:*:*:*:*:*

cpe:2.3:a:netapp:e-series_santricity_web_services_proxy:-:*:*:*:*:*:*:*

cpe:2.3:a:netapp:ontap_tools:9:*:*:*:*:vmware_vsphere:*:*

cpe:2.3:a:netapp:ontap_tools:10:*:*:*:*:vmware_vsphere:*:*

cpe:2.3:a:netapp:santricity_storage_plugin:-:*:*:*:*:vcenter:*:*

cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*

EPSS

Процентиль: 44%

0.00213

Низкий

4.3 Medium

CVSS3

Дефекты

CWE-400

Связанные уязвимости

CVE-2024-47554

CVSS3: 4.3

ubuntu

11 месяцев назад

Uncontrolled Resource Consumption vulnerability in Apache Commons IO. The org.apache.commons.io.input.XmlStreamReader class may excessively consume CPU resources when processing maliciously crafted input. This issue affects Apache Commons IO: from 2.0 before 2.14.0. Users are recommended to upgrade to version 2.14.0 or later, which fixes the issue.

CVE-2024-47554

CVSS3: 4.3

redhat

11 месяцев назад

CVE-2024-47554

msrc

10 месяцев назад

Описание отсутствует

CVE-2024-47554

CVSS3: 4.3

debian

11 месяцев назад

Uncontrolled Resource Consumption vulnerability in Apache Commons IO. ...

SUSE-SU-2024:3596-1

suse-cvrf

11 месяцев назад

Security update for apache-commons-io

EPSS

Процентиль: 44%

0.00213

Низкий

4.3 Medium

CVSS3

Дефекты

CWE-400