Описание
Uncontrolled Recursion vulnerability in Apache Commons.
When processing an untrusted configuration file, Commons Configuration will throw a StackOverflowError for YAML input with cycles.
This issue affects Apache Commons: from 2.2 before 2.15.0.
Users are recommended to upgrade to version 2.15.0, which fixes the issue.
A flaw was found in Apache Commons Configuration. When processing an untrusted configuration file, a remote attacker could provide specially crafted YAML input with cycles. This could lead to an uncontrolled recursion, causing a StackOverflowError and resulting in a Denial of Service (DoS) for the affected system.
Отчет
This Important flaw in Apache Commons Configuration allows a remote attacker to trigger a denial of service by providing specially crafted YAML input containing cycles. This can lead to an uncontrolled recursion and a StackOverflowError, impacting the availability of systems that process untrusted YAML configuration files.
Меры по смягчению последствий
To mitigate this issue, restrict Apache Commons Configuration to process only trusted YAML configuration files. Implement strict input validation for any YAML content originating from untrusted sources to prevent the parsing of malformed input with cyclical references. This operational control reduces the exposure to denial of service attacks.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| OpenShift Developer Tools and Services | jenkins-2-plugins | Affected | ||
| OpenShift Developer Tools and Services | ocp-tools-4/jenkins-rhel8 | Affected | ||
| OpenShift Developer Tools and Services | ocp-tools-4/jenkins-rhel9 | Affected | ||
| Red Hat AMQ Broker 7 | commons-configuration2 | Affected | ||
| Red Hat AMQ Clients | commons-configuration2 | Affected | ||
| Red Hat build of Apache Camel for Spring Boot 4 | commons-configuration2 | Affected | ||
| Red Hat build of Apicurio Registry 3 | commons-configuration2 | Affected | ||
| Red Hat Data Grid 8 | commons-configuration | Not affected | ||
| Red Hat Enterprise Linux 6 | qpid-cpp | Affected | ||
| Red Hat Enterprise Linux 6 | qpid-qmf | Affected |
Показывать по
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
Uncontrolled Recursion vulnerability in Apache Commons. When processing an untrusted configuration file, Commons Configuration will throw a StackOverflowError for YAML input with cycles. This issue affects Apache Commons: from 2.2 before 2.15.0. Users are recommended to upgrade to version 2.15.0, which fixes the issue.
Uncontrolled Recursion vulnerability in Apache Commons. When processing an untrusted configuration file, Commons Configuration will throw a StackOverflowError for YAML input with cycles. This issue affects Apache Commons: from 2.2 before 2.15.0. Users are recommended to upgrade to version 2.15.0, which fixes the issue.
Uncontrolled Recursion vulnerability in Apache Commons. When processi ...
Security update for apache-commons-configuration2, apache-commons-text
Apache Commons Configuration: StackOverflowError for YAML input with cycles
EPSS
7.5 High
CVSS3