Show plain JSON{"affected_release": [{"advisory": "RHSA-2023:3195", "cpe": "cpe:/a:redhat:ocp_tools:4.12::el8", "impact": "moderate", "package": "jenkins-2-plugins-0:4.12.1683009955-1.el8", "product_name": "OCP-Tools-4.12-RHEL-8", "release_date": "2023-05-18T00:00:00Z"}, {"advisory": "RHSA-2023:6172", "cpe": "cpe:/a:redhat:ocp_tools:4.12::el8", "impact": "moderate", "package": "jenkins-2-plugins-0:4.12.1698294000-1.el8", "product_name": "OCP-Tools-4.12-RHEL-8", "release_date": "2023-10-30T00:00:00Z"}, {"advisory": "RHSA-2024:0778", "cpe": "cpe:/a:redhat:ocp_tools:4.12::el8", "impact": "moderate", "package": "jenkins-2-plugins-0:4.12.1706515741-1.el8", "product_name": "OCP-Tools-4.12-RHEL-8", "release_date": "2024-02-12T00:00:00Z"}, {"advisory": "RHSA-2023:3299", "cpe": "cpe:/a:redhat:ocp_tools:4.13::el8", "impact": "moderate", "package": "jenkins-2-plugins-0:4.13.1684911916-1.el8", "product_name": "OCP-Tools-4.13-RHEL-8", "release_date": "2023-05-24T00:00:00Z"}, {"advisory": "RHSA-2023:6179", "cpe": "cpe:/a:redhat:ocp_tools:4.13::el8", "impact": "moderate", "package": "jenkins-2-plugins-0:4.13.1698292274-1.el8", "product_name": "OCP-Tools-4.13-RHEL-8", "release_date": "2023-10-30T00:00:00Z"}, {"advisory": "RHSA-2024:0776", "cpe": "cpe:/a:redhat:ocp_tools:4.13::el8", "impact": "moderate", "package": "jenkins-2-plugins-0:4.13.1706516346-1.el8", "product_name": "OCP-Tools-4.13-RHEL-8", "release_date": "2024-02-12T00:00:00Z"}, {"advisory": "RHSA-2023:7288", "cpe": "cpe:/a:redhat:ocp_tools:4.14::el8", "impact": "moderate", "package": "jenkins-2-plugins-0:4.14.1699356715-1.el8", "product_name": "OCP-Tools-4.14-RHEL-8", "release_date": "2023-11-16T00:00:00Z"}, {"advisory": "RHSA-2024:0777", "cpe": "cpe:/a:redhat:ocp_tools:4.14::el8", "impact": "moderate", "package": "jenkins-2-plugins-0:4.14.1706516441-1.el8", "product_name": "OCP-Tools-4.14-RHEL-8", "release_date": "2024-02-12T00:00:00Z"}, {"advisory": "RHSA-2023:3198", "cpe": "cpe:/a:redhat:ocp_tools:4.11::el8", "impact": "moderate", "package": "jenkins-2-plugins-0:4.11.1683009941-1.el8", "product_name": "OpenShift Developer Tools and Services for OCP 4.11", "release_date": "2023-05-17T00:00:00Z"}, {"advisory": "RHSA-2023:6171", "cpe": "cpe:/a:redhat:ocp_tools:4.11::el8", "impact": "moderate", "package": "jenkins-2-plugins-0:4.11.1698299029-1.el8", "product_name": "OpenShift Developer Tools and Services for OCP 4.11", "release_date": "2023-10-30T00:00:00Z"}, {"advisory": "RHSA-2024:0775", "cpe": "cpe:/a:redhat:ocp_tools:4.11::el8", "impact": "moderate", "package": "jenkins-2-plugins-0:4.11.1706516946-1.el8", "product_name": "OpenShift Developer Tools and Services for OCP 4.11", "release_date": "2024-02-12T00:00:00Z"}, {"advisory": "RHSA-2022:8876", "cpe": "cpe:/a:redhat:amq_broker:7", "impact": "moderate", "package": "commons-text", "product_name": "Red Hat AMQ Broker 7", "release_date": "2022-12-07T00:00:00Z"}, {"advisory": "RHSA-2024:3527", "cpe": "cpe:/a:redhat:amq_streams:2", "product_name": "Red Hat AMQ Streams 2.7.0", "release_date": "2024-05-30T00:00:00Z"}, {"advisory": "RHSA-2022:9023", "cpe": "cpe:/a:redhat:quarkus:2.13", "impact": "moderate", "package": "commons-text", "product_name": "Red Hat build of Quarkus 2.13.5", "release_date": "2022-12-14T00:00:00Z"}, {"advisory": "RHSA-2023:1006", "cpe": "cpe:/a:redhat:quarkus:2.7", "product_name": "Red Hat build of Quarkus 2.7.7", "release_date": "2023-03-08T00:00:00Z"}, {"advisory": "RHSA-2022:8652", "cpe": "cpe:/a:redhat:jboss_fuse:7", "impact": "moderate", "package": "commons-text", "product_name": "Red Hat Fuse 7.11.1", "release_date": "2022-11-28T00:00:00Z"}, {"advisory": "RHSA-2023:1655", "cpe": "cpe:/a:redhat:openshift:4.10::el8", "impact": "moderate", "package": "jenkins-2-plugins-0:4.10.1680703106-1.el8", "product_name": "Red Hat OpenShift Container Platform 4.10", "release_date": "2023-04-12T00:00:00Z"}, {"advisory": "RHSA-2023:1524", "cpe": "cpe:/a:redhat:openshift:4.9::el8", "impact": "moderate", "package": "jenkins-2-plugins-0:4.9.1680069756-1.el8", "product_name": "Red Hat OpenShift Container Platform 4.9", "release_date": "2023-04-05T00:00:00Z"}, {"advisory": "RHSA-2023:0261", "cpe": "cpe:/a:redhat:satellite:6.12::el8", "impact": "low", "package": "candlepin-0:4.1.18-1.el8sat", "product_name": "Red Hat Satellite 6.12 for RHEL 8", "release_date": "2023-01-18T00:00:00Z"}, {"advisory": "RHSA-2023:2097", "cpe": "cpe:/a:redhat:satellite:6.13::el8", "impact": "low", "package": "candlepin-0:4.2.13-1.el8sat", "product_name": "Red Hat Satellite 6.13 for RHEL 8", "release_date": "2023-05-03T00:00:00Z"}, {"advisory": "RHSA-2023:0469", "cpe": "cpe:/a:redhat:camel_quarkus:2.13", "impact": "low", "package": "commons-text", "product_name": "RHINT Camel-Q 2.13.2", "release_date": "2023-01-26T00:00:00Z"}, {"advisory": "RHSA-2022:8902", "cpe": "cpe:/a:redhat:camel_spring_boot:3.18.3", "impact": "moderate", "package": "commons-text", "product_name": "RHINT Camel-Springboot 3.18.3", "release_date": "2022-12-08T00:00:00Z"}, {"advisory": "RHSA-2023:2135", "cpe": "cpe:/a:redhat:jboss_enterprise_bpms_platform:7.13", "impact": "moderate", "package": "commons-text", "product_name": "RHPAM 7.13.1 async", "release_date": "2023-05-04T00:00:00Z"}], "bugzilla": {"description": "apache-commons-text: variable interpolation RCE", "id": "2135435", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135435"}, "csaw": false, "cvss3": {"cvss3_base_score": "9.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "verified"}, "cwe": "CWE-94->CWE-1188", "details": ["Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is \"${prefix:name}\", where \"prefix\" is used to locate an instance of org.apache.commons.text.lookup.StringLookup that performs the interpolation. Starting with version 1.5 and continuing through 1.9, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - \"script\" - execute expressions using the JVM script execution engine (javax.script) - \"dns\" - resolve dns records - \"url\" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Text 1.10.0, which disables the problematic interpolators by default.", "A flaw was found in Apache Commons Text packages 1.5 through 1.9. The affected versions allow an attacker to benefit from a variable interpolation process contained in Apache Commons Text, which can cause properties to be dynamically defined. Server applications are vulnerable to remote code execution (RCE) and unintentional contact with untrusted remote servers."], "mitigation": {"lang": "en:us", "value": "This flaw may be avoided by ensuring that any external inputs used with the Commons-Text lookup methods are sanitized properly. Untrusted input should always be thoroughly sanitized before using in any potentially risky situations."}, "name": "CVE-2022-42889", "package_state": [{"cpe": "cpe:/a:redhat:a_mq_clients:2", "fix_state": "Not affected", "package_name": "commons-text", "product_name": "A-MQ Clients 2"}, {"cpe": "cpe:/a:redhat:logging:5", "fix_state": "Not affected", "package_name": "openshift-logging/elasticsearch6-rhel8", "product_name": "Logging Subsystem for Red Hat OpenShift"}, {"cpe": "cpe:/a:redhat:amq_online:1", "fix_state": "Not affected", "package_name": "commons-text", "product_name": "Red Hat A-MQ Online"}, {"cpe": "cpe:/a:redhat:service_registry:2", "fix_state": "Not affected", "package_name": "commons-text", "product_name": "Red Hat build of Apicurio Registry"}, {"cpe": "cpe:/a:redhat:jboss_data_grid:8", "fix_state": "Not affected", "package_name": "commons-text", "product_name": "Red Hat Data Grid 8"}, {"cpe": "cpe:/a:redhat:integration:1", "fix_state": "Affected", "impact": "low", "package_name": "commons-text", "product_name": "Red Hat Integration Camel K"}, {"cpe": "cpe:/a:redhat:integration:1", "fix_state": "Not affected", "package_name": "commons-text", "product_name": "Red Hat Integration Change Data Capture"}, {"cpe": "cpe:/a:redhat:jboss_data_grid:7", "fix_state": "Not affected", "package_name": "commons-text", "product_name": "Red Hat JBoss Data Grid 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:6", "fix_state": "Not affected", "package_name": "commons-text", "product_name": "Red Hat JBoss Enterprise Application Platform 6"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7", "fix_state": "Not affected", "package_name": "commons-text", "product_name": "Red Hat JBoss Enterprise Application Platform 7"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Affected", "impact": "low", "package_name": "commons-text", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:5", "fix_state": "Not affected", "package_name": "commons-text", "product_name": "Red Hat JBoss Web Server 5"}, {"cpe": "cpe:/a:redhat:openshift:3.11", "fix_state": "Out of support scope", "impact": "moderate", "package_name": "jenkins-2-plugins", "product_name": "Red Hat OpenShift Container Platform 3.11"}, {"cpe": "cpe:/a:redhat:red_hat_single_sign_on:7", "fix_state": "Not affected", "package_name": "commons-text", "product_name": "Red Hat Single Sign-On 7"}, {"cpe": "cpe:/a:redhat:openshift_application_runtimes:1.0", "fix_state": "Not affected", "package_name": "commons-text", "product_name": "Red Hat support for Spring Boot"}, {"cpe": "cpe:/a:redhat:amq_streams:1", "fix_state": "Not affected", "package_name": "commons-text", "product_name": "streams for Apache Kafka"}], "public_date": "2022-10-13T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2022-42889\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-42889\nhttps://blogs.apache.org/security/entry/cve-2022-42889\nhttps://lists.apache.org/thread/n2bd4vdsgkqh2tm14l1wyc3jyol7s1om\nhttps://seclists.org/oss-sec/2022/q4/22"], "statement": "In order to carry successful exploitation of this vulnerability, the following conditions must be in place on the affected target:\n- Usage of specific methods that interpolate the variables as described in the flaw\n- Usage of external input for those methods\n- Usage of that external input has to be unsanitized/no \"allow list\"/etc.\nThe following products have *Low* impact because they have maven references to the affected package but do not ship it nor use the code:\n- Red Hat EAP Expansion Pack (EAP-XP)\n- Red Hat Camel-K\n- Red Hat Camel-Quarkus\nRed Hat Satellite ships Candlepin that embeds Apache Commons Text, however, it is not vulnerable to the flaw since the library has not been exposed in the product code. In Candlepin, the Commons Text is being pulled for the Liquibase and ActiveMQ Artemis libraries as a dependency. Red Hat Product Security has evaluated and rated the impact of the flaw as Low for Satellite since there was no harm identified to the confidentiality, integrity, or availability of systems.\n- The OCP has a *Moderate* impact because the affected library is a third-party library in the OCP jenkins-2-plugin component which reduces the possibilities of successful exploitation.\n- The OCP-4.8 is affected by this CVE and is in an extended life phase. For versions of products in the Extended Life Phase, Red Hat will provide limited ongoing technical support. No bug fixes, security fixes, hardware enablement or root-cause analysis will be available during this phase, and support will be provided on existing installations only.", "threat_severity": "Critical", "upstream_fix": "commons-text 1.10.0"}