|
Security VulnerabilitiesFor information about reporting or asking questions about security, please see the security page of the Apache Commons project. This page lists all security vulnerabilities fixed in released versions of this component. Please note that binary patches are never provided. If you need to apply a source code patch, use the building instructions for the component version that you are using. If you need help on building this component or other help on following the instructions to mitigate the known vulnerabilities listed here, please send your questions to the public user mailing list . If you have encountered an unlisted security vulnerability or other unexpected behavior that has security impact, or if the descriptions here are incomplete, please report them privately to the Apache Security Team. Thank you. CVE-2022-42889 prior to 1.10.0, RCE when applied to untrusted inputOn 2022-10-13, the Apache Commons Text team disclosed CVE-2022-42889 . Key takeaways:
Apache Commons Text is a low-level library for performing various text operations, such as escaping, calculating string differences, and substituting placeholders in the text with values looked up through interpolators. When using the string substitution feature, some of the available interpolators can trigger network access or code execution. This is intended, but it also means an application that includes user input in the string passed to the substitution without properly sanitizing it would allow an attacker to trigger those interpolators. For that reason the Apache Commons Text team have decided to update the configuration to be more "secure by default", so that the impact of a failure to validate inputs is mitigated and will not give an attacker access to these interpolators. However, it is still recommended that users treat untrusted input with care. We're not currently aware of any applications that pass untrusted input to the substitutor and thus would have been impacted by this problem prior to Apache Commons Text 1.10.0. This issue is different from Log4Shell (CVE-2021-44228) because in Log4Shell, string interpolation was possible from the log message body, which commonly contains untrusted input. In the Apache Common Text issue, the relevant method is explicitly intended and clearly documented to perform string interpolation, so it is much less likely that applications would inadvertently pass in untrusted input without proper validation. Credit: this issue was reported independently by Ruilin and by @pwntester (Alvaro Muñoz) of the GitHub Security Lab team . Thank you! References: |