CVE-2020-13936: Velocity Sandbox Bypass

Published Mar 9, 2021
·
Updated

A flaw was found in velocity. An attacker, able to modify Velocity templates, may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Other sources

An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache Velocity Engine versions up to 2.2.

Apache Velocity could allow a remote attacker to execute arbitrary code on the system, caused by a sandbox bypass flaw. By modifying the Velocity templates, an attacker could exploit this vulnerability to execute arbitrary code with the same privileges as the account running the Servlet container.

Affected Software

95 affected componentsFixes available
ubuntu/velocity<1.7-5ubuntu0.18.04.1~
1.7-5ubuntu0.18.04.1~
ubuntu/velocity<1.7-5+
1.7-5+
ubuntu/velocity<1.7-4ubuntu0.1~
1.7-4ubuntu0.1~
debian/velocity
1.7-5+deb10u11.7-6
redhat/eap7-artemis-wildfly-integration<0:1.0.4-1.redhat_00001.1.el6ea
0:1.0.4-1.redhat_00001.1.el6ea
redhat/eap7-bouncycastle<0:1.68.0-2.redhat_00005.1.el6ea
0:1.68.0-2.redhat_00005.1.el6ea
redhat/eap7-hal-console<0:3.2.14-1.Final_redhat_00001.1.el6ea
0:3.2.14-1.Final_redhat_00001.1.el6ea
redhat/eap7-infinispan<0:9.4.22-3.Final_redhat_00001.1.el6ea
0:9.4.22-3.Final_redhat_00001.1.el6ea
redhat/eap7-ironjacamar<0:1.4.30-1.Final_redhat_00001.1.el6ea
0:1.4.30-1.Final_redhat_00001.1.el6ea
redhat/eap7-jboss-genericjms<0:2.0.9-1.Final_redhat_00001.1.el6ea
0:2.0.9-1.Final_redhat_00001.1.el6ea
redhat/eap7-jboss-marshalling<0:2.0.11-1.Final_redhat_00001.1.el6ea
0:2.0.11-1.Final_redhat_00001.1.el6ea
redhat/eap7-jboss-server-migration<0:1.7.2-6.Final_redhat_00007.1.el6ea
0:1.7.2-6.Final_redhat_00007.1.el6ea
redhat/eap7-jboss-weld<3.1-api-0:3.1.0-6.SP3_redhat_00001.1.el6ea
3.1-api-0:3.1.0-6.SP3_redhat_00001.1.el6ea
redhat/eap7-jgroups-kubernetes<0:1.0.16-1.Final_redhat_00001.1.el6ea
0:1.0.16-1.Final_redhat_00001.1.el6ea
redhat/eap7-netty<0:4.1.60-1.Final_redhat_00001.1.el6ea
0:4.1.60-1.Final_redhat_00001.1.el6ea
redhat/eap7-resteasy<0:3.11.4-1.Final_redhat_00001.1.el6ea
0:3.11.4-1.Final_redhat_00001.1.el6ea
redhat/eap7-undertow<0:2.0.35-1.SP1_redhat_00001.1.el6ea
0:2.0.35-1.SP1_redhat_00001.1.el6ea
redhat/eap7-velocity<0:2.3.0-1.redhat_00001.1.el6ea
0:2.3.0-1.redhat_00001.1.el6ea
redhat/eap7-weld-core<0:3.1.6-1.Final_redhat_00001.1.el6ea
0:3.1.6-1.Final_redhat_00001.1.el6ea
redhat/eap7-wildfly<0:7.3.7-1.GA_redhat_00002.1.el6ea
0:7.3.7-1.GA_redhat_00002.1.el6ea
redhat/eap7-wildfly-elytron<0:1.10.12-1.Final_redhat_00001.1.el6ea
0:1.10.12-1.Final_redhat_00001.1.el6ea
redhat/eap7-wildfly-http-client<0:1.0.26-1.Final_redhat_00001.1.el6ea
0:1.0.26-1.Final_redhat_00001.1.el6ea
redhat/eap7-xalan-j2<0:2.7.1-36.redhat_00013.1.el6ea
0:2.7.1-36.redhat_00013.1.el6ea
redhat/eap7-yasson<0:1.0.9-1.redhat_00001.1.el6ea
0:1.0.9-1.redhat_00001.1.el6ea
redhat/eap7-artemis-wildfly-integration<0:1.0.4-1.redhat_00001.1.el7ea
0:1.0.4-1.redhat_00001.1.el7ea
redhat/eap7-bouncycastle<0:1.68.0-2.redhat_00005.1.el7ea
0:1.68.0-2.redhat_00005.1.el7ea
redhat/eap7-hal-console<0:3.2.14-1.Final_redhat_00001.1.el7ea
0:3.2.14-1.Final_redhat_00001.1.el7ea
redhat/eap7-infinispan<0:9.4.22-3.Final_redhat_00001.1.el7ea
0:9.4.22-3.Final_redhat_00001.1.el7ea
redhat/eap7-ironjacamar<0:1.4.30-1.Final_redhat_00001.1.el7ea
0:1.4.30-1.Final_redhat_00001.1.el7ea
redhat/eap7-jboss-genericjms<0:2.0.9-1.Final_redhat_00001.1.el7ea
0:2.0.9-1.Final_redhat_00001.1.el7ea
redhat/eap7-jboss-marshalling<0:2.0.11-1.Final_redhat_00001.1.el7ea
0:2.0.11-1.Final_redhat_00001.1.el7ea
redhat/eap7-jboss-server-migration<0:1.7.2-6.Final_redhat_00007.1.el7ea
0:1.7.2-6.Final_redhat_00007.1.el7ea
redhat/eap7-jboss-weld<3.1-api-0:3.1.0-6.SP3_redhat_00001.1.el7ea
3.1-api-0:3.1.0-6.SP3_redhat_00001.1.el7ea
redhat/eap7-jgroups-kubernetes<0:1.0.16-1.Final_redhat_00001.1.el7ea
0:1.0.16-1.Final_redhat_00001.1.el7ea
redhat/eap7-netty<0:4.1.60-1.Final_redhat_00001.1.el7ea
0:4.1.60-1.Final_redhat_00001.1.el7ea
redhat/eap7-resteasy<0:3.11.4-1.Final_redhat_00001.1.el7ea
0:3.11.4-1.Final_redhat_00001.1.el7ea
redhat/eap7-undertow<0:2.0.35-1.SP1_redhat_00001.1.el7ea
0:2.0.35-1.SP1_redhat_00001.1.el7ea
redhat/eap7-velocity<0:2.3.0-1.redhat_00001.1.el7ea
0:2.3.0-1.redhat_00001.1.el7ea
redhat/eap7-weld-core<0:3.1.6-1.Final_redhat_00001.1.el7ea
0:3.1.6-1.Final_redhat_00001.1.el7ea
redhat/eap7-wildfly<0:7.3.7-1.GA_redhat_00002.1.el7ea
0:7.3.7-1.GA_redhat_00002.1.el7ea
redhat/eap7-wildfly-elytron<0:1.10.12-1.Final_redhat_00001.1.el7ea
0:1.10.12-1.Final_redhat_00001.1.el7ea
redhat/eap7-wildfly-http-client<0:1.0.26-1.Final_redhat_00001.1.el7ea
0:1.0.26-1.Final_redhat_00001.1.el7ea
redhat/eap7-xalan-j2<0:2.7.1-36.redhat_00013.1.el7ea
0:2.7.1-36.redhat_00013.1.el7ea
redhat/eap7-yasson<0:1.0.9-1.redhat_00001.1.el7ea
0:1.0.9-1.redhat_00001.1.el7ea
redhat/eap7-artemis-wildfly-integration<0:1.0.4-1.redhat_00001.1.el8ea
0:1.0.4-1.redhat_00001.1.el8ea
redhat/eap7-bouncycastle<0:1.68.0-2.redhat_00005.1.el8ea
0:1.68.0-2.redhat_00005.1.el8ea
redhat/eap7-hal-console<0:3.2.14-1.Final_redhat_00001.1.el8ea
0:3.2.14-1.Final_redhat_00001.1.el8ea
redhat/eap7-infinispan<0:9.4.22-3.Final_redhat_00001.1.el8ea
0:9.4.22-3.Final_redhat_00001.1.el8ea
redhat/eap7-ironjacamar<0:1.4.30-1.Final_redhat_00001.1.el8ea
0:1.4.30-1.Final_redhat_00001.1.el8ea
redhat/eap7-jboss-genericjms<0:2.0.9-1.Final_redhat_00001.1.el8ea
0:2.0.9-1.Final_redhat_00001.1.el8ea
redhat/eap7-jboss-marshalling<0:2.0.11-1.Final_redhat_00001.1.el8ea
0:2.0.11-1.Final_redhat_00001.1.el8ea
redhat/eap7-jboss-server-migration<0:1.7.2-6.Final_redhat_00007.1.el8ea
0:1.7.2-6.Final_redhat_00007.1.el8ea
redhat/eap7-jboss-weld<3.1-api-0:3.1.0-6.SP3_redhat_00001.1.el8ea
3.1-api-0:3.1.0-6.SP3_redhat_00001.1.el8ea
redhat/eap7-jgroups-kubernetes<0:1.0.16-1.Final_redhat_00001.1.el8ea
0:1.0.16-1.Final_redhat_00001.1.el8ea
redhat/eap7-netty<0:4.1.60-1.Final_redhat_00001.1.el8ea
0:4.1.60-1.Final_redhat_00001.1.el8ea
redhat/eap7-resteasy<0:3.11.4-1.Final_redhat_00001.1.el8ea
0:3.11.4-1.Final_redhat_00001.1.el8ea
redhat/eap7-undertow<0:2.0.35-1.SP1_redhat_00001.1.el8ea
0:2.0.35-1.SP1_redhat_00001.1.el8ea
redhat/eap7-velocity<0:2.3.0-1.redhat_00001.1.el8ea
0:2.3.0-1.redhat_00001.1.el8ea
redhat/eap7-weld-core<0:3.1.6-1.Final_redhat_00001.1.el8ea
0:3.1.6-1.Final_redhat_00001.1.el8ea
redhat/eap7-wildfly<0:7.3.7-1.GA_redhat_00002.1.el8ea
0:7.3.7-1.GA_redhat_00002.1.el8ea
redhat/eap7-wildfly-elytron<0:1.10.12-1.Final_redhat_00001.1.el8ea
0:1.10.12-1.Final_redhat_00001.1.el8ea
redhat/eap7-wildfly-http-client<0:1.0.26-1.Final_redhat_00001.1.el8ea
0:1.0.26-1.Final_redhat_00001.1.el8ea
redhat/eap7-xalan-j2<0:2.7.1-36.redhat_00013.1.el8ea
0:2.7.1-36.redhat_00013.1.el8ea
redhat/eap7-yasson<0:1.0.9-1.redhat_00001.1.el8ea
0:1.0.9-1.redhat_00001.1.el8ea
IBM Sterling External Authentication Server<=6.0.3
IBM Sterling External Authentication Server<=6.1.0
redhat/velocity<2.3
2.3
Apache Velocity Engine<2.3
Apache WSS4J=2.3.1
Debian Debian Linux=9.0
Oracle Banking Deposits And Lines Of Credit Servicing=2.12.0
Oracle Banking Enterprise Default Management>=2.3.0<=2.4.1
Oracle Banking Enterprise Default Management=2.6.2
Oracle Banking Enterprise Default Management=2.7.1
Oracle Banking Enterprise Default Management=2.10.0
Oracle Banking Enterprise Default Management=2.12.0
Oracle Banking Loans Servicing=2.12.0
Oracle Banking Party Management=2.7.0
Oracle Banking Platform>=2.3.0<=2.4.1
Oracle Banking Platform=2.6.2
Oracle Banking Platform=2.7.1
Oracle Communications Cloud Native Core Policy=1.14.0
Oracle Communications Network Integrity=7.3.6
Oracle Hospitality Token Proxy Service=19.2
Oracle Retail Integration Bus=19.0.1
Oracle Retail Order Broker=16.0
Oracle Retail Service Backbone=19.0.1
Oracle Retail Xstore Office Cloud Service=16.0.6
Oracle Retail Xstore Office Cloud Service=17.0.4
Oracle Retail Xstore Office Cloud Service=18.0.3
Oracle Retail Xstore Office Cloud Service=19.0.2
Oracle Retail Xstore Office Cloud Service=20.0.1
Oracle Utilities Testing Accelerator=6.0.0.1.1
Oracle Utilities Testing Accelerator=6.0.0.2.2
Oracle Utilities Testing Accelerator=6.0.0.3.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade ubuntu/velocity to a version that resolves this vulnerability.

    Fixed in 1.7-5ubuntu0.18.04.1~
  2. Upgrade

    Upgrade ubuntu/velocity to a version that resolves this vulnerability.

    Fixed in 1.7-5+
  3. Upgrade

    Upgrade ubuntu/velocity to a version that resolves this vulnerability.

    Fixed in 1.7-4ubuntu0.1~
  4. Upgrade

    Upgrade debian/velocity to a version that resolves this vulnerability.

    Fixed in 1.7-5+deb10u1Fixed in 1.7-6
  5. Upgrade

    Upgrade redhat/eap7-artemis-wildfly-integration to a version that resolves this vulnerability.

    Fixed in 0:1.0.4-1.redhat_00001.1.el6ea
  6. Upgrade

    Upgrade redhat/eap7-bouncycastle to a version that resolves this vulnerability.

    Fixed in 0:1.68.0-2.redhat_00005.1.el6ea
  7. Upgrade

    Upgrade redhat/eap7-hal-console to a version that resolves this vulnerability.

    Fixed in 0:3.2.14-1.Final_redhat_00001.1.el6ea
  8. Upgrade

    Upgrade redhat/eap7-infinispan to a version that resolves this vulnerability.

    Fixed in 0:9.4.22-3.Final_redhat_00001.1.el6ea
  9. Upgrade

    Upgrade redhat/eap7-ironjacamar to a version that resolves this vulnerability.

    Fixed in 0:1.4.30-1.Final_redhat_00001.1.el6ea
  10. Upgrade

    Upgrade redhat/eap7-jboss-genericjms to a version that resolves this vulnerability.

    Fixed in 0:2.0.9-1.Final_redhat_00001.1.el6ea
  11. Upgrade

    Upgrade redhat/eap7-jboss-marshalling to a version that resolves this vulnerability.

    Fixed in 0:2.0.11-1.Final_redhat_00001.1.el6ea
  12. Upgrade

    Upgrade redhat/eap7-jboss-server-migration to a version that resolves this vulnerability.

    Fixed in 0:1.7.2-6.Final_redhat_00007.1.el6ea
  13. Upgrade

    Upgrade redhat/eap7-jboss-weld to a version that resolves this vulnerability.

    Fixed in 3.1-api-0:3.1.0-6.SP3_redhat_00001.1.el6ea
  14. Upgrade

    Upgrade redhat/eap7-jgroups-kubernetes to a version that resolves this vulnerability.

    Fixed in 0:1.0.16-1.Final_redhat_00001.1.el6ea
  15. Upgrade

    Upgrade redhat/eap7-netty to a version that resolves this vulnerability.

    Fixed in 0:4.1.60-1.Final_redhat_00001.1.el6ea
  16. Upgrade

    Upgrade redhat/eap7-resteasy to a version that resolves this vulnerability.

    Fixed in 0:3.11.4-1.Final_redhat_00001.1.el6ea
  17. Upgrade

    Upgrade redhat/eap7-undertow to a version that resolves this vulnerability.

    Fixed in 0:2.0.35-1.SP1_redhat_00001.1.el6ea
  18. Upgrade

    Upgrade redhat/eap7-velocity to a version that resolves this vulnerability.

    Fixed in 0:2.3.0-1.redhat_00001.1.el6ea
  19. Upgrade

    Upgrade redhat/eap7-weld-core to a version that resolves this vulnerability.

    Fixed in 0:3.1.6-1.Final_redhat_00001.1.el6ea
  20. Upgrade

    Upgrade redhat/eap7-wildfly to a version that resolves this vulnerability.

    Fixed in 0:7.3.7-1.GA_redhat_00002.1.el6ea
  21. Upgrade

    Upgrade redhat/eap7-wildfly-elytron to a version that resolves this vulnerability.

    Fixed in 0:1.10.12-1.Final_redhat_00001.1.el6ea
  22. Upgrade

    Upgrade redhat/eap7-wildfly-http-client to a version that resolves this vulnerability.

    Fixed in 0:1.0.26-1.Final_redhat_00001.1.el6ea
  23. Upgrade

    Upgrade redhat/eap7-xalan-j2 to a version that resolves this vulnerability.

    Fixed in 0:2.7.1-36.redhat_00013.1.el6ea
  24. Upgrade

    Upgrade redhat/eap7-yasson to a version that resolves this vulnerability.

    Fixed in 0:1.0.9-1.redhat_00001.1.el6ea
  25. Upgrade

    Upgrade redhat/eap7-artemis-wildfly-integration to a version that resolves this vulnerability.

    Fixed in 0:1.0.4-1.redhat_00001.1.el7ea
  26. Upgrade

    Upgrade redhat/eap7-bouncycastle to a version that resolves this vulnerability.

    Fixed in 0:1.68.0-2.redhat_00005.1.el7ea
  27. Upgrade

    Upgrade redhat/eap7-hal-console to a version that resolves this vulnerability.

    Fixed in 0:3.2.14-1.Final_redhat_00001.1.el7ea
  28. Upgrade

    Upgrade redhat/eap7-infinispan to a version that resolves this vulnerability.

    Fixed in 0:9.4.22-3.Final_redhat_00001.1.el7ea
  29. Upgrade

    Upgrade redhat/eap7-ironjacamar to a version that resolves this vulnerability.

    Fixed in 0:1.4.30-1.Final_redhat_00001.1.el7ea
  30. Upgrade

    Upgrade redhat/eap7-jboss-genericjms to a version that resolves this vulnerability.

    Fixed in 0:2.0.9-1.Final_redhat_00001.1.el7ea
  31. Upgrade

    Upgrade redhat/eap7-jboss-marshalling to a version that resolves this vulnerability.

    Fixed in 0:2.0.11-1.Final_redhat_00001.1.el7ea
  32. Upgrade

    Upgrade redhat/eap7-jboss-server-migration to a version that resolves this vulnerability.

    Fixed in 0:1.7.2-6.Final_redhat_00007.1.el7ea
  33. Upgrade

    Upgrade redhat/eap7-jboss-weld to a version that resolves this vulnerability.

    Fixed in 3.1-api-0:3.1.0-6.SP3_redhat_00001.1.el7ea
  34. Upgrade

    Upgrade redhat/eap7-jgroups-kubernetes to a version that resolves this vulnerability.

    Fixed in 0:1.0.16-1.Final_redhat_00001.1.el7ea
  35. Upgrade

    Upgrade redhat/eap7-netty to a version that resolves this vulnerability.

    Fixed in 0:4.1.60-1.Final_redhat_00001.1.el7ea
  36. Upgrade

    Upgrade redhat/eap7-resteasy to a version that resolves this vulnerability.

    Fixed in 0:3.11.4-1.Final_redhat_00001.1.el7ea
  37. Upgrade

    Upgrade redhat/eap7-undertow to a version that resolves this vulnerability.

    Fixed in 0:2.0.35-1.SP1_redhat_00001.1.el7ea
  38. Upgrade

    Upgrade redhat/eap7-velocity to a version that resolves this vulnerability.

    Fixed in 0:2.3.0-1.redhat_00001.1.el7ea
  39. Upgrade

    Upgrade redhat/eap7-weld-core to a version that resolves this vulnerability.

    Fixed in 0:3.1.6-1.Final_redhat_00001.1.el7ea
  40. Upgrade

    Upgrade redhat/eap7-wildfly to a version that resolves this vulnerability.

    Fixed in 0:7.3.7-1.GA_redhat_00002.1.el7ea
  41. Upgrade

    Upgrade redhat/eap7-wildfly-elytron to a version that resolves this vulnerability.

    Fixed in 0:1.10.12-1.Final_redhat_00001.1.el7ea
  42. Upgrade

    Upgrade redhat/eap7-wildfly-http-client to a version that resolves this vulnerability.

    Fixed in 0:1.0.26-1.Final_redhat_00001.1.el7ea
  43. Upgrade

    Upgrade redhat/eap7-xalan-j2 to a version that resolves this vulnerability.

    Fixed in 0:2.7.1-36.redhat_00013.1.el7ea
  44. Upgrade

    Upgrade redhat/eap7-yasson to a version that resolves this vulnerability.

    Fixed in 0:1.0.9-1.redhat_00001.1.el7ea
  45. Upgrade

    Upgrade redhat/eap7-artemis-wildfly-integration to a version that resolves this vulnerability.

    Fixed in 0:1.0.4-1.redhat_00001.1.el8ea
  46. Upgrade

    Upgrade redhat/eap7-bouncycastle to a version that resolves this vulnerability.

    Fixed in 0:1.68.0-2.redhat_00005.1.el8ea
  47. Upgrade

    Upgrade redhat/eap7-hal-console to a version that resolves this vulnerability.

    Fixed in 0:3.2.14-1.Final_redhat_00001.1.el8ea
  48. Upgrade

    Upgrade redhat/eap7-infinispan to a version that resolves this vulnerability.

    Fixed in 0:9.4.22-3.Final_redhat_00001.1.el8ea
  49. Upgrade

    Upgrade redhat/eap7-ironjacamar to a version that resolves this vulnerability.

    Fixed in 0:1.4.30-1.Final_redhat_00001.1.el8ea
  50. Upgrade

    Upgrade redhat/eap7-jboss-genericjms to a version that resolves this vulnerability.

    Fixed in 0:2.0.9-1.Final_redhat_00001.1.el8ea
  51. Upgrade

    Upgrade redhat/eap7-jboss-marshalling to a version that resolves this vulnerability.

    Fixed in 0:2.0.11-1.Final_redhat_00001.1.el8ea
  52. Upgrade

    Upgrade redhat/eap7-jboss-server-migration to a version that resolves this vulnerability.

    Fixed in 0:1.7.2-6.Final_redhat_00007.1.el8ea
  53. Upgrade

    Upgrade redhat/eap7-jboss-weld to a version that resolves this vulnerability.

    Fixed in 3.1-api-0:3.1.0-6.SP3_redhat_00001.1.el8ea
  54. Upgrade

    Upgrade redhat/eap7-jgroups-kubernetes to a version that resolves this vulnerability.

    Fixed in 0:1.0.16-1.Final_redhat_00001.1.el8ea
  55. Upgrade

    Upgrade redhat/eap7-netty to a version that resolves this vulnerability.

    Fixed in 0:4.1.60-1.Final_redhat_00001.1.el8ea
  56. Upgrade

    Upgrade redhat/eap7-resteasy to a version that resolves this vulnerability.

    Fixed in 0:3.11.4-1.Final_redhat_00001.1.el8ea
  57. Upgrade

    Upgrade redhat/eap7-undertow to a version that resolves this vulnerability.

    Fixed in 0:2.0.35-1.SP1_redhat_00001.1.el8ea
  58. Upgrade

    Upgrade redhat/eap7-velocity to a version that resolves this vulnerability.

    Fixed in 0:2.3.0-1.redhat_00001.1.el8ea
  59. Upgrade

    Upgrade redhat/eap7-weld-core to a version that resolves this vulnerability.

    Fixed in 0:3.1.6-1.Final_redhat_00001.1.el8ea
  60. Upgrade

    Upgrade redhat/eap7-wildfly to a version that resolves this vulnerability.

    Fixed in 0:7.3.7-1.GA_redhat_00002.1.el8ea
  61. Upgrade

    Upgrade redhat/eap7-wildfly-elytron to a version that resolves this vulnerability.

    Fixed in 0:1.10.12-1.Final_redhat_00001.1.el8ea
  62. Upgrade

    Upgrade redhat/eap7-wildfly-http-client to a version that resolves this vulnerability.

    Fixed in 0:1.0.26-1.Final_redhat_00001.1.el8ea
  63. Upgrade

    Upgrade redhat/eap7-xalan-j2 to a version that resolves this vulnerability.

    Fixed in 0:2.7.1-36.redhat_00013.1.el8ea
  64. Upgrade

    Upgrade redhat/eap7-yasson to a version that resolves this vulnerability.

    Fixed in 0:1.0.9-1.redhat_00001.1.el8ea
  65. Upgrade

    Upgrade redhat/velocity to a version that resolves this vulnerability.

    Fixed in 2.3

Event History

Mar 9, 2021
CVE Published
12:00 AM
Mar 10, 2021
CVE Published
via MITRE·08:00 AM
Data Sourced
via MITRE·08:00 AM
DescriptionWeakness
Data Sourced
via Red Hat·04:38 PM
DescriptionSeverityAffected Software
Oct 9, 2023
Data Sourced
11:28 AM
Description
Oct 31, 58339
Event
01:26 AM

Parent advisories

This vulnerability appears in the following advisories.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2020-13936?

CVE-2020-13936 has been classified as a critical severity vulnerability due to its potential to allow remote code execution.

2

How do I fix CVE-2020-13936?

To fix CVE-2020-13936, upgrade Apache Velocity to version 1.7-5 or higher, depending on your specific operating system.

3

What software is affected by CVE-2020-13936?

CVE-2020-13936 affects Apache Velocity versions prior to 1.7-5, as well as several packages in Debian and Red Hat that utilize the affected versions.

4

What types of attacks can exploit CVE-2020-13936?

CVE-2020-13936 can be exploited by remote attackers to execute arbitrary code, creating serious security risks for the impacted systems.

5

Is there a workaround for CVE-2020-13936?

Currently, there are no known workarounds for CVE-2020-13936; patching is the recommended approach to mitigate the vulnerability.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203