CVE-2022-42889: Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults
First published: Thu Oct 13 2022(Updated: )
A flaw was found in Apache Commons Text packages 1.5 through 1.9. The affected versions allow an attacker to benefit from a variable interpolation process contained in Apache Commons Text, which can cause properties to be dynamically defined. Server applications are vulnerable to remote code execution (RCE) and unintentional contact with untrusted remote servers.
Credit: security@apache.org security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/jenkins | <2-plugins-0:4.11.1683009941-1.el8 | 2-plugins-0:4.11.1683009941-1.el8 |
| redhat/jenkins | <2-plugins-0:4.12.1683009955-1.el8 | 2-plugins-0:4.12.1683009955-1.el8 |
| redhat/jenkins | <2-plugins-0:4.13.1684911916-1.el8 | 2-plugins-0:4.13.1684911916-1.el8 |
| redhat/jenkins | <2-plugins-0:4.10.1680703106-1.el8 | 2-plugins-0:4.10.1680703106-1.el8 |
| redhat/jenkins | <2-plugins-0:4.9.1680069756-1.el8 | 2-plugins-0:4.9.1680069756-1.el8 |
| redhat/candlepin | <0:4.1.18-1.el8 | 0:4.1.18-1.el8 |
| redhat/candlepin | <0:4.2.13-1.el8 | 0:4.2.13-1.el8 |
| Apache Commons Text | >=1.5<1.10.0 | |
| Netapp Bluexp | ||
| Juniper Security Threat Response Manager | <7.5.0 | |
| Juniper Security Threat Response Manager | =7.5.0 | |
| Juniper Security Threat Response Manager | =7.5.0-up1 | |
| Juniper Security Threat Response Manager | =7.5.0-up2 | |
| Juniper Security Threat Response Manager | =7.5.0-up3 | |
| Juniper Jsa1500 | ||
| IBM Security Guardium | ||
| IBM Security Guardium | ||
| IBM Security Guardium | ||
| IBM Security Guardium | ||
| IBM Security Guardium | ||
| IBM Security Guardium | ||
| IBM Security Guardium | <=11.3 | |
| IBM Security Guardium | <=11.4 | |
| IBM Security Guardium | <=11.5 | |
| redhat/commons-text | <1.10.0 | 1.10.0 |
| All of | ||
| Any of | ||
| Juniper Security Threat Response Manager | <7.5.0 | |
| Juniper Security Threat Response Manager | =7.5.0 | |
| Juniper Security Threat Response Manager | =7.5.0-up1 | |
| Juniper Security Threat Response Manager | =7.5.0-up2 | |
| Juniper Security Threat Response Manager | =7.5.0-up3 | |
| Any of | ||
| Juniper Jsa1500 | ||
| IBM Security Guardium | ||
| IBM Security Guardium | ||
| IBM Security Guardium | ||
| IBM Security Guardium | ||
| IBM Security Guardium | ||
| IBM Security Guardium | ||
| maven/com.guicedee.services:commons-text | <=1.2.2.1-jre17 | |
| maven/org.apache.commons:commons-text | >=1.5<1.10.0 | 1.10.0 |
| >=1.5<1.10.0 | ||
| All of | ||
| Any of | ||
| <7.5.0 | ||
| =7.5.0 | ||
| =7.5.0-up1 | ||
| =7.5.0-up2 | ||
| =7.5.0-up3 | ||
| Any of | ||
Remedy
This flaw may be avoided by ensuring that any external inputs used with the Commons-Text lookup methods are sanitized properly. Untrusted input should always be thoroughly sanitized before using in any potentially risky situations.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cve.org/CVERecord?id=CVE-2022-42889 https://nvd.nist.gov/vuln/detail/CVE-2022-42889 https://blogs.apache.org/security/entry/cve-2022-42889 https://lists.apache.org/thread/n2bd4vdsgkqh2tm14l1wyc3jyol7s1om https://seclists.org/oss-sec/2022/q4/22
- https://bugzilla.redhat.com/show_bug.cgi?id=2135435
- https://access.redhat.com/errata/RHSA-2023:3198
- https://access.redhat.com/errata/RHSA-2023:3195
- https://access.redhat.com/errata/RHSA-2023:3299
- https://access.redhat.com/errata/RHSA-2022:8876
- https://access.redhat.com/errata/RHSA-2022:9023
- https://access.redhat.com/errata/RHSA-2023:1006
- https://access.redhat.com/errata/RHSA-2022:8902
- https://access.redhat.com/errata/RHSA-2023:0469
- https://access.redhat.com/errata/RHSA-2022:8652
- https://access.redhat.com/errata/RHSA-2023:1655
- https://access.redhat.com/errata/RHSA-2023:1524
- https://access.redhat.com/errata/RHSA-2023:0261
- https://access.redhat.com/errata/RHSA-2023:2097
- https://access.redhat.com/security/cve/cve-2022-42889
- http://packetstormsecurity.com/files/171003/OX-App-Suite-Cross-Site-Scripting-Server-Side-Request-Forgery.html
- http://seclists.org/fulldisclosure/2023/Feb/3
- http://www.openwall.com/lists/oss-security/2022/10/13/4
- http://www.openwall.com/lists/oss-security/2022/10/18/1
- https://lists.apache.org/thread/n2bd4vdsgkqh2tm14l1wyc3jyol7s1om
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0022
- https://security.gentoo.org/glsa/202301-05
- https://security.netapp.com/advisory/ntap-20221020-0004/
- https://exchange.xforce.ibmcloud.com/vulnerabilities/238560
- https://www.ibm.com/support/pages/node/6848317 (Advisory)
- http://packetstormsecurity.com/files/176650/Apache-Commons-Text-1.9-Remote-Code-Execution.html
- https://nvd.nist.gov/vuln/detail/CVE-2022-42889
- https://securitylab.github.com/advisories/GHSL-2022-018_Apache_Commons_Text
- https://arxiv.org/pdf/2306.05534
- https://github.com/advisories/GHSA-599f-7c49-w659 (Advisory)
- https://github.com/jbossas/jboss-eap7/blob/EAP_7.4.7.CR3-dev/pom.xml
- https://access.redhat.com/errata/RHSA-2023:1866
- https://access.redhat.com/errata/RHSA-2023:2135
- https://access.redhat.com/errata/RHSA-2023:6179
- https://access.redhat.com/errata/RHSA-2023:7288
- https://access.redhat.com/errata/RHSA-2024:0776
- https://access.redhat.com/errata/RHSA-2024:0777
- https://access.redhat.com/errata/RHSA-2024:0778
- https://access.redhat.com/errata/RHSA-2024:0775
- https://access.redhat.com/errata/RHSA-2024:3527
Parent vulnerabilities
(Appears in the following advisories)
Frequently Asked Questions
What is CVE-2022-42889?
CVE-2022-42889 is a vulnerability in Apache Commons Text that could allow a remote attacker to execute arbitrary code on the system.
What is the severity of CVE-2022-42889?
CVE-2022-42889 has a severity keyword of 'critical' and a severity value of 9.8.
How does CVE-2022-42889 affect Apache Commons Text?
CVE-2022-42889 affects Apache Commons Text by allowing properties to be dynamically evaluated and expanded, which can be exploited by an attacker to execute arbitrary code on the system.
How can I fix CVE-2022-42889 in Apache Commons Text?
To fix CVE-2022-42889 in Apache Commons Text, update to version 1.10.0 or later.
Where can I find more information about CVE-2022-42889?
You can find more information about CVE-2022-42889 on the GitHub page and the Red Hat security advisories linked in the references.
- collector/redhat-cve
- collector/nvd-index
- agent/type
- agent/first-publish-date
- agent/severity
- agent/remedy
- agent/weakness
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/description
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/author
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-599f-7c49-w659
- alias/CVE-2022-42889
- agent/softwarecombine
- agent/event
- collector/nvd-cve
- collector/github-advisory
- collector/redhat-bugzilla
- source/Red Hat
- agent/references
- agent/last-modified-date
- agent/tags
- collector/ibm-support
- source/IBM
- package-manager/redhat
- vendor/apache
- canonical/apache commons text
- version/apache commons text/1.5
- vendor/netapp
- canonical/netapp bluexp
- vendor/juniper
- canonical/juniper security threat response manager
- version/juniper security threat response manager/7.5.0
- version/juniper security threat response manager/7.5.0-up1
- version/juniper security threat response manager/7.5.0-up2
- version/juniper security threat response manager/7.5.0-up3
- canonical/juniper jsa1500
- canonical/ibm security guardium
- package-manager/maven
- vendor/ibm
- version/ibm security guardium/11.3
- version/ibm security guardium/11.4
- version/ibm security guardium/11.5