Описание
Apache Commons Configuration uses a third-party library to parse YAML files which by default allows the instantiation of classes if the YAML includes special statements. Apache Commons Configuration versions 2.2, 2.3, 2.4, 2.5, 2.6 did not change the default settings of this library. So if a YAML file was loaded from an untrusted source, it could therefore load and execute code out of the control of the host application.
A flaw was found in the Apache Commons Configuration, where it uses a third-party library to process YAML files, which by default, allows the instantiation of classes if the YAML includes special statements. Apache Commons Configuration versions 2.2, 2.3, 2.4, 2.5, 2.6 did not change the default settings of this library. If a YAML file was loaded from an untrusted source, it could load and execute code out of the control of the host application.
Отчет
Several packages are unaffected because they do not include support for YAML configurations:
apache-commons-configurationas shipped with Red Hat Enterprise Linux 7apache-commons-configurationas shipped with Red Hat Enterprise Virtualizationrh-maven35-apache-commons-configurationas shipped with Red Hat Software Collectionscommons-configurationas shipped with Red Hat Gluster Storage
Меры по смягчению последствий
There is currently no mitigation available for this vulnerability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| A-MQ Clients 2 | commons-configuration2 | Not affected | ||
| Red Hat A-MQ Online | commons-configuration2 | Not affected | ||
| Red Hat BPM Suite 6 | commons-configuration | Not affected | ||
| Red Hat Decision Manager 7 | commons-configuration | Not affected | ||
| Red Hat Enterprise Linux 7 | apache-commons-configuration | Not affected | ||
| Red Hat JBoss BRMS 5 | commons-configuration | Out of support scope | ||
| Red Hat JBoss BRMS 6 | commons-configuration | Not affected | ||
| Red Hat JBoss Data Grid 7 | commons-configuration2 | Not affected | ||
| Red Hat JBoss Enterprise Application Platform 6 | commons-configuration | Not affected | ||
| Red Hat JBoss Enterprise Application Platform 7 | commons-configuration2 | Not affected |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
9 Critical
CVSS3
Связанные уязвимости
Apache Commons Configuration uses a third-party library to parse YAML files which by default allows the instantiation of classes if the YAML includes special statements. Apache Commons Configuration versions 2.2, 2.3, 2.4, 2.5, 2.6 did not change the default settings of this library. So if a YAML file was loaded from an untrusted source, it could therefore load and execute code out of the control of the host application.
Apache Commons Configuration uses a third-party library to parse YAML files which by default allows the instantiation of classes if the YAML includes special statements. Apache Commons Configuration versions 2.2, 2.3, 2.4, 2.5, 2.6 did not change the default settings of this library. So if a YAML file was loaded from an untrusted source, it could therefore load and execute code out of the control of the host application.
Apache Commons Configuration uses a third-party library to parse YAML ...
Remote code execution in Apache Commons Configuration
Уязвимость библиотеки библиотеки Apache Commons Configuration, связанная с недостаточной проверкой вводимых данных, позволяющая нарушителю выполнить произвольный код
EPSS
9 Critical
CVSS3