Apache Commons Configuration performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.configuration2.interpol.Lookup that performs the interpolation. Starting with version 2.4 and continuing through 2.7, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - "script" - execute expressions using the JVM script execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Configuration 2.8.0, which disables the problematic interpolators by default.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade rubygem-unf_ext-debugsourceUpgrade satellite-cliUpgrade satellite-maintainUpgrade rubygem-hammer_cli_katelloUpgrade foreman-cliUpgrade rubygem-unicodeUpgrade rubygem-unicode-display_widthUpgrade rubygem-hashieUpgrade rubygem-foreman_maintainUpgrade rubygem-apipie-bindingsUpgrade rubygem-highlineUpgrade rubygem-unicode-debuginfoUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-netrcUpgrade rubygem-ffiUpgrade satellite-cloneUpgrade rubygem-oauthUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-little-pluggerUpgrade rubygem-oauth-ttyUpgrade rubygem-unfUpgrade rubygem-rest-clientUpgrade rubygem-mime-types-dataUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-snaky_hashUpgrade rubygem-ffi-debuginfoUpgrade rubygem-version_gemUpgrade rubygem-clampUpgrade rubygem-http-cookieUpgrade rubygem-http-acceptUpgrade rubygem-powerbarUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-multi_jsonUpgrade python39-pulp_manifestUpgrade rubygem-hammer_cliUpgrade rubygem-loggingUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-localeUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-gssapiUpgrade rubygem-ffi-debugsourceUpgrade rubygem-fast_gettextUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-domain_nameUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-amazing_printUpgrade rubygem-unf_extUpgrade rubygem-unicode-debugsource | May 4, 2023 | Jul 6, 2022 |
| Debian | — | Upgrade commons-configuration2 | Nov 30, 2022 | Jul 6, 2022 |
| Progress Moveit Automation | — | Upgrade Progress MOVEit Automation to the latest version | Dec 13, 2024 | Jul 6, 2022 |
| Redhat_linux | — | Upgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-unicode-debugsourceUpgrade rubygem-domain_nameUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-netrcUpgrade rubygem-little-pluggerUpgrade rubygem-ffi-debugsourceUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-powerbarUpgrade rubygem-unicode-debuginfoUpgrade rubygem-jwtUpgrade rubygem-oauth-ttyUpgrade rubygem-apipie-bindingsUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-unfUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade satellite-cloneUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-mime-typesUpgrade rubygem-http-cookieUpgrade rubygem-loggingUpgrade rubygem-multi_jsonUpgrade rubygem-http-acceptUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-hammer_cli_foreman_googleUpgrade satellite-cliUpgrade rubygem-unicode-display_widthUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-snaky_hashUpgrade rubygem-ffiUpgrade rubygem-unicodeUpgrade rubygem-hashieUpgrade rubygem-oauthUpgrade rubygem-amazing_printUpgrade rubygem-mime-types-dataUpgrade rubygem-rest-clientUpgrade rubygem-highlineUpgrade rubygem-fast_gettextUpgrade rubygem-localeUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade python39-pulp_manifestUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-version_gemUpgrade rubygem-unf_extUpgrade rubygem-clampUpgrade rubygem-foreman_maintainUpgrade foreman-cliUpgrade rubygem-gssapiUpgrade satellite-maintainUpgrade rubygem-ffi-debuginfoUpgrade rubygem-hammer_cli | May 4, 2023 | Jul 6, 2022 |
| Rocky_linux | — | Upgrade libdb-cxxUpgrade libdb-debugsourceUpgrade libdb-utils-debuginfoUpgrade libdb-cxx-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-debuginfoUpgrade libdb-sql-debuginfo | Mar 12, 2024 | Jul 6, 2022 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub