Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

oracle-oval логотип

ELSA-2025-10814

Опубликовано: 30 июл. 2025
Источник: oracle-oval
Платформа: Oracle Linux 7

Описание

ELSA-2025-10814: apache-commons-beanutils security update (IMPORTANT)

[1.8.3-15.0.1]

  • Add SuppressPropertiesBeanIntrospector.SUPPRESS_DECLARING_CLASS [Orabug: 38176946][CVE-2025-48734]

[1.8.3-15]

  • Fix CVE-2014-0114
  • Fix CVE-2019-10086

[1.8.3-14]

  • Mass rebuild 2013-12-27

[1.8.3-13]

  • Add BuildRequires on apache-commons-parent >= 26-7
  • Remove BuildRequires on commons-collections-testframework

[1.8.3-12]

  • Remove workaround for rpm bug #646523

[1.8.3-11]

  • Rebuild to regenerate API documentation
  • Resolves: CVE-2013-1571

[1.8.3-10]

  • Build with xmvn
  • Don't generate extra JARs
  • Simplify build dependencies
  • Update to current packaging guidelines

[1.8.3-9]

[1.8.3-8]

[1.8.3-7]

[1.8.3-6]

[1.8.3-5]

  • Packaging fixes
  • Remove unneeded depmap
  • Remove versioned jars and javadocs
  • Use maven 3 to build

[1.8.3-4]

[1.8.3-3]

  • Add license to javadoc subpackage

[1.8.3-2]

  • Added provides to javadoc subpackage

[1.8.3-1]

  • Re-did whole spec file, dropped gcj support
  • Rename package (jakarta-commons-beanutils->apache-commons-beanutils)

[0:1.7.0-12.3]

[0:1.7.0-11.3]

[0:1.7.0-10.3]

  • Fedora-specific: enable GCJ support

[0:1.7.0-10.2]

  • Fedora-specific: BuildRequires: java-1.6.0-devel

[0:1.7.0-10.1]

  • Fedora-specific: remove repolib
  • Fedora-specific: enable JDK6 support

[0:1.7.0-10]

  • add flag to build with maven

[0:1.7.0-9]

  • add jdk6 patch
  • fix repolib

[0:1.7.0-8.jpp5]

  • fix duplicate files
  • correctly unpack sources
  • remove spurious gnu-crypto requirement
  • remove spurious javadoc package requirements
  • fix javadoc directory
  • fix build-classpath call
  • use macros

[0:1.7.0-7]

  • First JPP5 build

[0:1.7.0-6jpp]

  • Make Vendor, Distribution based on macro
  • Fix aot build
  • Add poms and depmap frags
  • Build with maven1 by default
  • Add manual subpackage when built with maven

[0:1.7.0-2jpp.ep1.2]

  • Fix repolib location

[0:1.7.0-2jpp.ep1.1]

  • New repolib location

[0:1.7.0-2jpp.el4ep1.3]

  • Remove pre section used for RHUG cleanup

[0:1.7.0-2jpp.el4ep1.2]

  • Add -brew suffix

[0:1.7.0-2jpp.el4ep1.1]

  • Add repolib support

[0:1.7.0-5jpp]

  • Require what is used in post/postun for javadoc

[0:1.7.0-4jpp]

  • Add AOT bits

[0:1.7.0-3jpp]

  • Add header
  • Remove unecessary macro definitions

[0:1.7.0-2jpp_1rh]

  • Merge with upstream

[0:1.7.0-1jpp_3rh]

  • Fix build so that collections jar is created

[0:1.7.0-2jpp]

  • Use the 'dist' target to get a full build, including bean-collections

[0:1.7.0-1jpp_1rh]

  • Import from upstream

[0:1.7.0-1jpp]

  • Upgrade to 1.7.0

[0:1.6.1-4jpp_6rh]

  • add coreutils BuildRequires

[0:1.6.1-5jpp]

  • Rebuild with ant-1.6.2

[0:1.6.1-4jpp_5rh]

  • Added trigger to restore symlinks that are removed if ugrading from a commons-beanutils rhug package

[0:1.6.1-4jpp_4rh]

  • more of the same, for version-suffixed .jar files

[0:1.6.1-4jpp_3rh]

  • add RHUG upgrade cleanup

[0:1.6.1-4jpp_2rh]

  • RH vacuuming part II

[0:1.6.1-4jpp_1rh]

  • RH vacuuming

[0:1.6.1-4jpp]

  • update for JPackage 1.5

[1.6.1-2jpp]

  • fix ASF license and add packager name

[1.6.1-1jpp]

  • 1.6.1

[1.6-1jpp]

  • 1.6

[1.5-1jpp]

  • 1.5

[1.4.1-1jpp]

  • 1.4.1

[1.4-1jpp]

  • 1.4

[1.3-3jpp]

  • change to commons-xxx.jar instead of commons-xxx.home in ant parameters

[1.3-2jpp]

  • use sed instead of bash 2.x extension in link area to make spec compatible with distro using bash 1.1x

[1.3-1jpp]

  • 1.3
  • added short names in %{_javadir}, as does jakarta developpers
  • first jPackage release

Обновленные пакеты

Oracle Linux 7

Oracle Linux x86_64

apache-commons-beanutils

1.8.3-15.0.1.el7_9

apache-commons-beanutils-javadoc

1.8.3-15.0.1.el7_9

Связанные CVE

Связанные уязвимости

CVSS3: 8.8
ubuntu
2 месяца назад

Improper Access Control vulnerability in Apache Commons. A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this protection was not enabled by default. PropertyUtilsBean (and consequently BeanUtilsBean) now disallows declared class level property access by default. Releases 1.11.0 and 2.0.0-M2 address a potential security issue when accessing enum properties in an uncontrolled way. If an application using Commons BeanUtils passes property paths from an external source directly to the getProperty() method of PropertyUtilsBean, an attacker can access the enum’s class loader via the “declaredClass” property available on all Java “enum” objects. Accessing the enum’s “declaredClass” allows remote attackers to access the ClassLoader and execute arbitrary code. The same issue exists with PropertyUtilsBean.getNestedProperty(). Sta...

CVSS3: 8.8
redhat
2 месяца назад

Improper Access Control vulnerability in Apache Commons. A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this protection was not enabled by default. PropertyUtilsBean (and consequently BeanUtilsBean) now disallows declared class level property access by default. Releases 1.11.0 and 2.0.0-M2 address a potential security issue when accessing enum properties in an uncontrolled way. If an application using Commons BeanUtils passes property paths from an external source directly to the getProperty() method of PropertyUtilsBean, an attacker can access the enum’s class loader via the “declaredClass” property available on all Java “enum” objects. Accessing the enum’s “declaredClass” allows remote attackers to access the ClassLoader and execute arbitrary code. The same issue exists with PropertyUtilsBean.getNestedProperty(). Sta...

CVSS3: 8.8
nvd
2 месяца назад

Improper Access Control vulnerability in Apache Commons. A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this protection was not enabled by default. PropertyUtilsBean (and consequently BeanUtilsBean) now disallows declared class level property access by default. Releases 1.11.0 and 2.0.0-M2 address a potential security issue when accessing enum properties in an uncontrolled way. If an application using Commons BeanUtils passes property paths from an external source directly to the getProperty() method of PropertyUtilsBean, an attacker can access the enum’s class loader via the “declaredClass” property available on all Java “enum” objects. Accessing the enum’s “declaredClass” allows remote attackers to access the ClassLoader and execute arbitrary code. The same issue exists with PropertyUtilsBean.getNestedProperty()

CVSS3: 8.8
debian
2 месяца назад

Improper Access Control vulnerability in Apache Commons. A special ...

suse-cvrf
2 месяца назад

Security update for apache-commons-beanutils