Apache Commons Configuration performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.configuration2.interpol.Lookup that performs the interpolation. Starting with version 2.4 and continuing through 2.7, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - "script" - execute expressions using the JVM script execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Configuration 2.8.0, which disables the problematic interpolators by default.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade rubygem-http-cookieUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-snaky_hashUpgrade rubygem-multi_jsonUpgrade rubygem-ffi-debuginfoUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-gssapiUpgrade rubygem-http-acceptUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-fast_gettextUpgrade rubygem-unicode-debugsourceUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-powerbarUpgrade rubygem-loggingUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-version_gemUpgrade python39-pulp_manifestUpgrade rubygem-hammer_cliUpgrade rubygem-ffi-debugsourceUpgrade rubygem-clampUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-domain_nameUpgrade rubygem-jwtUpgrade rubygem-localeUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-amazing_printUpgrade rubygem-unf_extUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-netrcUpgrade rubygem-unicode-debuginfoUpgrade rubygem-unfUpgrade rubygem-unicodeUpgrade rubygem-hashieUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-foreman_maintainUpgrade rubygem-unicode-display_widthUpgrade satellite-cloneUpgrade satellite-maintainUpgrade satellite-cliUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-mime-types-dataUpgrade rubygem-rest-clientUpgrade foreman-cliUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-oauth-ttyUpgrade rubygem-apipie-bindingsUpgrade rubygem-ffiUpgrade rubygem-little-pluggerUpgrade rubygem-highlineUpgrade rubygem-oauth | May 4, 2023 | Jul 6, 2022 |
| Debian | — | Upgrade commons-configuration2 | Nov 30, 2022 | Jul 6, 2022 |
| Progress Moveit Automation | — | Upgrade Progress MOVEit Automation to the latest version | Dec 13, 2024 | Jul 6, 2022 |
| Redhat_linux | — | Upgrade satellite-cliUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-ffiUpgrade rubygem-multi_jsonUpgrade rubygem-oauth-ttyUpgrade rubygem-unicode-debugsourceUpgrade rubygem-powerbarUpgrade rubygem-apipie-bindingsUpgrade rubygem-little-pluggerUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-unicode-debuginfoUpgrade rubygem-ffi-debugsourceUpgrade rubygem-netrcUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-mime-typesUpgrade satellite-cloneUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-loggingUpgrade rubygem-http-acceptUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-domain_nameUpgrade rubygem-snaky_hashUpgrade rubygem-http-cookieUpgrade rubygem-unfUpgrade rubygem-unicodeUpgrade rubygem-unicode-display_widthUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-highlineUpgrade rubygem-clampUpgrade rubygem-localeUpgrade rubygem-ffi-debuginfoUpgrade satellite-maintainUpgrade rubygem-gssapiUpgrade rubygem-version_gemUpgrade rubygem-mime-types-dataUpgrade rubygem-hammer_cliUpgrade rubygem-foreman_maintainUpgrade rubygem-hammer_cli_foreman_tasksUpgrade foreman-cliUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-rest-clientUpgrade rubygem-oauthUpgrade rubygem-amazing_printUpgrade rubygem-fast_gettextUpgrade rubygem-unf_extUpgrade rubygem-hashieUpgrade python39-pulp_manifest | May 4, 2023 | Jul 6, 2022 |
| Rocky_linux | — | Upgrade libdb-cxxUpgrade libdb-utils-debuginfoUpgrade libdb-debugsourceUpgrade libdb-sql-devel-debuginfoUpgrade libdb-cxx-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-debuginfo | Mar 12, 2024 | Jul 6, 2022 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub