DSA-5290: -1 commons-configuration2 -- security update
Published Nov 28, 2022
·Updated
Apache Commons Configuration, a Java library providing a generic configuration interface, performs variable interpolation, allowing properties to be dynamically evaluated and expanded. Starting with version 2.4 and continuing through 2.7, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are:
Other sources
commons-configuration2 - security update
— Debian
Affected Software
2 affected components
debian/commons-configuration2
debian/commons-configuration2
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
commons-configuration2to a version that resolves this vulnerability.Patch DSA-5290-1
Event History
Nov 28, 2022
Advisory Published
12:00 AM