REDHAT-BUG-2379554: Low severity Apache Commons Lang vulnerability
Uncontrolled Recursion vulnerability in Apache Commons Lang.
This issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0.
The methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a StackOverflowError could cause an application to stop.
Users are recommended to upgrade to version 3.18.0, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
org.apache.commons:commons-lang3to a version that resolves this vulnerability.Fixed in 3.18.0
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2379554?
The severity of REDHAT-BUG-2379554 is considered high due to the potential for StackOverflowError leading to application crashes.
How do I fix REDHAT-BUG-2379554?
To fix REDHAT-BUG-2379554, update Apache Commons Lang to version 2.7 or later, or to version 3.18.0 or above.
What versions are affected by REDHAT-BUG-2379554?
REDHAT-BUG-2379554 affects Apache Commons Lang versions from 2.0 to 2.6, and from 3.0 up to 3.18.0.
What is the nature of the vulnerability in REDHAT-BUG-2379554?
The nature of the vulnerability in REDHAT-BUG-2379554 is an uncontrolled recursion issue that can lead to a StackOverflowError.
Is there a workaround for REDHAT-BUG-2379554?
There is no official workaround for REDHAT-BUG-2379554; upgrading to the patched versions is the recommended solution.