{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-42889", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "assignerShortName": "apache", "dateUpdated": "2024-11-20T16:19:41.416Z", "dateReserved": "2022-10-12T00:00:00", "datePublished": "2022-10-13T00:00:00"}, "containers": {"cna": {"title": "Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults", "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2024-01-19T16:06:47.362105"}, "descriptions": [{"lang": "en", "value": "Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is \"${prefix:name}\", where \"prefix\" is used to locate an instance of org.apache.commons.text.lookup.StringLookup that performs the interpolation. Starting with version 1.5 and continuing through 1.9, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - \"script\" - execute expressions using the JVM script execution engine (javax.script) - \"dns\" - resolve dns records - \"url\" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Text 1.10.0, which disables the problematic interpolators by default."}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Commons Text", "versions": [{"version": "unspecified", "lessThanOrEqual": "1.9", "status": "affected", "versionType": "custom"}, {"version": "1.5", "status": "affected", "lessThan": "Apache Commons Text*", "versionType": "custom"}]}], "references": [{"url": "https://lists.apache.org/thread/n2bd4vdsgkqh2tm14l1wyc3jyol7s1om"}, {"name": "[oss-security] 20221013 CVE-2022-42889: Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults", "tags": ["mailing-list"], "url": "http://www.openwall.com/lists/oss-security/2022/10/13/4"}, {"name": "[oss-security] 20221017 Re: CVE-2022-42889: Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults", "tags": ["mailing-list"], "url": "http://www.openwall.com/lists/oss-security/2022/10/18/1"}, {"url": "https://security.netapp.com/advisory/ntap-20221020-0004/"}, {"url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0022"}, {"name": "GLSA-202301-05", "tags": ["vendor-advisory"], "url": "https://security.gentoo.org/glsa/202301-05"}, {"name": "20230214 OXAS-ADV-2022-0002: OX App Suite Security Advisory", "tags": ["mailing-list"], "url": "http://seclists.org/fulldisclosure/2023/Feb/3"}, {"url": "http://packetstormsecurity.com/files/171003/OX-App-Suite-Cross-Site-Scripting-Server-Side-Request-Forgery.html"}, {"url": "http://packetstormsecurity.com/files/176650/Apache-Commons-Text-1.9-Remote-Code-Execution.html"}], "metrics": [{"other": {"type": "unknown", "content": {"other": "important"}}}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "Unexpected variable interpolation"}]}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "source": {"discovery": "UNKNOWN"}, "workarounds": [{"lang": "en", "value": "Upgrade to Apache Commons Text 1.10.0."}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T13:19:05.212Z"}, "title": "CVE Program Container", "references": [{"url": "https://lists.apache.org/thread/n2bd4vdsgkqh2tm14l1wyc3jyol7s1om", "tags": ["x_transferred"]}, {"name": "[oss-security] 20221013 CVE-2022-42889: Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults", "tags": ["mailing-list", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2022/10/13/4"}, {"name": "[oss-security] 20221017 Re: CVE-2022-42889: Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults", "tags": ["mailing-list", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2022/10/18/1"}, {"url": "https://security.netapp.com/advisory/ntap-20221020-0004/", "tags": ["x_transferred"]}, {"url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0022", "tags": ["x_transferred"]}, {"name": "GLSA-202301-05", "tags": ["vendor-advisory", "x_transferred"], "url": "https://security.gentoo.org/glsa/202301-05"}, {"name": "20230214 OXAS-ADV-2022-0002: OX App Suite Security Advisory", "tags": ["mailing-list", "x_transferred"], "url": "http://seclists.org/fulldisclosure/2023/Feb/3"}, {"url": "http://packetstormsecurity.com/files/171003/OX-App-Suite-Cross-Site-Scripting-Server-Side-Request-Forgery.html", "tags": ["x_transferred"]}, {"url": "http://packetstormsecurity.com/files/176650/Apache-Commons-Text-1.9-Remote-Code-Execution.html", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-01-24T16:22:10.690380Z", "id": "CVE-2022-42889", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-20T16:19:41.416Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.apache.org/thread/n2bd4vdsgkqh2tm14l1wyc3jyol7s1om", "tags": ["x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2022/10/13/4", "name": "[oss-security] 20221013 CVE-2022-42889: Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults", "tags": ["mailing-list", "x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2022/10/18/1", "name": "[oss-security] 20221017 Re: CVE-2022-42889: Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults", "tags": ["mailing-list", "x_transferred"]}, {"url": "https://security.netapp.com/advisory/ntap-20221020-0004/", "tags": ["x_transferred"]}, {"url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0022", "tags": ["x_transferred"]}, {"url": "https://security.gentoo.org/glsa/202301-05", "name": "GLSA-202301-05", "tags": ["vendor-advisory", "x_transferred"]}, {"url": "http://seclists.org/fulldisclosure/2023/Feb/3", "name": "20230214 OXAS-ADV-2022-0002: OX App Suite Security Advisory", "tags": ["mailing-list", "x_transferred"]}, {"url": "http://packetstormsecurity.com/files/171003/OX-App-Suite-Cross-Site-Scripting-Server-Side-Request-Forgery.html", "tags": ["x_transferred"]}, {"url": "http://packetstormsecurity.com/files/176650/Apache-Commons-Text-1.9-Remote-Code-Execution.html", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T13:19:05.212Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-42889", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-01-24T16:22:10.690380Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-20T16:19:24.000Z"}}], "cna": {"title": "Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults", "source": {"discovery": "UNKNOWN"}, "metrics": [{"other": {"type": "unknown", "content": {"other": "important"}}}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Commons Text", "versions": [{"status": "affected", "version": "unspecified", "versionType": "custom", "lessThanOrEqual": "1.9"}, {"status": "affected", "version": "1.5", "lessThan": "Apache Commons Text*", "versionType": "custom"}]}], "references": [{"url": "https://lists.apache.org/thread/n2bd4vdsgkqh2tm14l1wyc3jyol7s1om"}, {"url": "http://www.openwall.com/lists/oss-security/2022/10/13/4", "name": "[oss-security] 20221013 CVE-2022-42889: Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults", "tags": ["mailing-list"]}, {"url": "http://www.openwall.com/lists/oss-security/2022/10/18/1", "name": "[oss-security] 20221017 Re: CVE-2022-42889: Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults", "tags": ["mailing-list"]}, {"url": "https://security.netapp.com/advisory/ntap-20221020-0004/"}, {"url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0022"}, {"url": "https://security.gentoo.org/glsa/202301-05", "name": "GLSA-202301-05", "tags": ["vendor-advisory"]}, {"url": "http://seclists.org/fulldisclosure/2023/Feb/3", "name": "20230214 OXAS-ADV-2022-0002: OX App Suite Security Advisory", "tags": ["mailing-list"]}, {"url": "http://packetstormsecurity.com/files/171003/OX-App-Suite-Cross-Site-Scripting-Server-Side-Request-Forgery.html"}, {"url": "http://packetstormsecurity.com/files/176650/Apache-Commons-Text-1.9-Remote-Code-Execution.html"}], "workarounds": [{"lang": "en", "value": "Upgrade to Apache Commons Text 1.10.0."}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "descriptions": [{"lang": "en", "value": "Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is \"${prefix:name}\", where \"prefix\" is used to locate an instance of org.apache.commons.text.lookup.StringLookup that performs the interpolation. Starting with version 1.5 and continuing through 1.9, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - \"script\" - execute expressions using the JVM script execution engine (javax.script) - \"dns\" - resolve dns records - \"url\" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Text 1.10.0, which disables the problematic interpolators by default."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "Unexpected variable interpolation"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2024-01-19T16:06:47.362105"}}}, "cveMetadata": {"cveId": "CVE-2022-42889", "state": "PUBLISHED", "dateUpdated": "2024-11-20T16:19:41.416Z", "dateReserved": "2022-10-12T00:00:00", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2022-10-13T00:00:00", "assignerShortName": "apache"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:commons_text:*:*:*:*:*:*:*:*", "matchCriteriaId": "F52B385F-442F-4587-B680-DD74CC525D27", "versionEndExcluding": "1.10.0", "versionStartIncluding": "1.5", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:netapp:bluexp:-:*:*:*:*:*:*:*", "matchCriteriaId": "FC1AE8BD-EE3F-494C-9F03-D4B2B7233106", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:h:juniper:jsa1500:-:*:*:*:*:*:*:*", "matchCriteriaId": "D6F62545-4393-4FD6-9EF4-3516E8835F58", "vulnerable": false}, {"criteria": "cpe:2.3:h:juniper:jsa3500:-:*:*:*:*:*:*:*", "matchCriteriaId": "BBF05B6A-B4F6-4F7A-927E-106A8C1E8ED7", "vulnerable": false}, {"criteria": "cpe:2.3:h:juniper:jsa3800:-:*:*:*:*:*:*:*", "matchCriteriaId": "421FD233-CA15-4207-8690-6A1C4C23BDB8", "vulnerable": false}, {"criteria": "cpe:2.3:h:juniper:jsa5500:-:*:*:*:*:*:*:*", "matchCriteriaId": "08C686CC-C971-4891-B8F9-9BE4C09B1160", "vulnerable": false}, {"criteria": "cpe:2.3:h:juniper:jsa5800:-:*:*:*:*:*:*:*", "matchCriteriaId": "9075ED11-DD7E-49E2-90F5-50ACFCD2F4A4", "vulnerable": false}, {"criteria": "cpe:2.3:h:juniper:jsa7500:-:*:*:*:*:*:*:*", "matchCriteriaId": "57A506DE-88CE-45C9-A41A-9B5B4E62F36C", "vulnerable": false}, {"criteria": "cpe:2.3:h:juniper:jsa7800:-:*:*:*:*:*:*:*", "matchCriteriaId": "7AFBD1EF-96B1-475E-896A-4000463FEA0A", "vulnerable": false}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:a:juniper:security_threat_response_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "334BA50E-637D-42E7-AD73-BC13498D79D0", "versionEndExcluding": "7.5.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:juniper:security_threat_response_manager:7.5.0:-:*:*:*:*:*:*", "matchCriteriaId": "F5745211-E47A-481B-928F-B56013DAC19C", "vulnerable": true}, {"criteria": "cpe:2.3:a:juniper:security_threat_response_manager:7.5.0:up1:*:*:*:*:*:*", "matchCriteriaId": "1B716977-E015-4628-854B-5828FC3DC150", "vulnerable": true}, {"criteria": "cpe:2.3:a:juniper:security_threat_response_manager:7.5.0:up2:*:*:*:*:*:*", "matchCriteriaId": "22F53DC6-084C-4C06-9A5C-550511E5CC58", "vulnerable": true}, {"criteria": "cpe:2.3:a:juniper:security_threat_response_manager:7.5.0:up3:*:*:*:*:*:*", "matchCriteriaId": "41FFF517-DCAC-4CF1-A6D7-29828B037245", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is \"${prefix:name}\", where \"prefix\" is used to locate an instance of org.apache.commons.text.lookup.StringLookup that performs the interpolation. Starting with version 1.5 and continuing through 1.9, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - \"script\" - execute expressions using the JVM script execution engine (javax.script) - \"dns\" - resolve dns records - \"url\" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Text 1.10.0, which disables the problematic interpolators by default."}, {"lang": "es", "value": "Apache Commons Text lleva a cabo una interpolaci\u00f3n de variables, permitiendo que las propiedades sean evaluadas y expandidas din\u00e1micamente. El formato est\u00e1ndar para la interpolaci\u00f3n es \"${prefix:name}\", donde \"prefix\" es usado para localizar una instancia de org.apache.commons.text.lookup.StringLookup que lleva a cabo la interpolaci\u00f3n. A partir de la versi\u00f3n 1.5 y hasta 1.9, el conjunto de instancias de Lookup por defecto inclu\u00eda interpoladores que pod\u00edan dar lugar a una ejecuci\u00f3n de c\u00f3digo arbitrario o al contacto con servidores remotos. Estos lookups son: - \"script\" - ejecuta expresiones usando el motor de ejecuci\u00f3n de scripts de la JVM (javax.script) - \"dns\" - resuelve registros dns - \"url\" - carga valores de urls, incluso de servidores remotos Las aplicaciones usando los interpoladores por defecto en las versiones afectadas pueden ser vulnerables a una ejecuci\u00f3n de c\u00f3digo remota o al contacto involuntario con servidores remotos si son usados valores de configuraci\u00f3n que no son confiables. Es recomendado a usuarios actualizar a Apache Commons Text versi\u00f3n 1.10.0, que deshabilita los interpoladores problem\u00e1ticos por defecto"}], "id": "CVE-2022-42889", "lastModified": "2024-01-19T16:15:08.583", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-10-13T13:15:10.113", "references": [{"source": "security@apache.org", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://packetstormsecurity.com/files/171003/OX-App-Suite-Cross-Site-Scripting-Server-Side-Request-Forgery.html"}, {"source": "security@apache.org", "url": "http://packetstormsecurity.com/files/176650/Apache-Commons-Text-1.9-Remote-Code-Execution.html"}, {"source": "security@apache.org", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://seclists.org/fulldisclosure/2023/Feb/3"}, {"source": "security@apache.org", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2022/10/13/4"}, {"source": "security@apache.org", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2022/10/18/1"}, {"source": "security@apache.org", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://lists.apache.org/thread/n2bd4vdsgkqh2tm14l1wyc3jyol7s1om"}, {"source": "security@apache.org", "tags": ["Third Party Advisory"], "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0022"}, {"source": "security@apache.org", "tags": ["Third Party Advisory"], "url": "https://security.gentoo.org/glsa/202301-05"}, {"source": "security@apache.org", "tags": ["Third Party Advisory"], "url": "https://security.netapp.com/advisory/ntap-20221020-0004/"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2023:3195", "cpe": "cpe:/a:redhat:ocp_tools:4.12::el8", "impact": "moderate", "package": "jenkins-2-plugins-0:4.12.1683009955-1.el8", "product_name": "OCP-Tools-4.12-RHEL-8", "release_date": "2023-05-18T00:00:00Z"}, {"advisory": "RHSA-2023:6172", "cpe": "cpe:/a:redhat:ocp_tools:4.12::el8", "impact": "moderate", "package": "jenkins-2-plugins-0:4.12.1698294000-1.el8", "product_name": "OCP-Tools-4.12-RHEL-8", "release_date": "2023-10-30T00:00:00Z"}, {"advisory": "RHSA-2024:0778", "cpe": "cpe:/a:redhat:ocp_tools:4.12::el8", "impact": "moderate", "package": "jenkins-2-plugins-0:4.12.1706515741-1.el8", "product_name": "OCP-Tools-4.12-RHEL-8", "release_date": "2024-02-12T00:00:00Z"}, {"advisory": "RHSA-2023:3299", "cpe": "cpe:/a:redhat:ocp_tools:4.13::el8", "impact": "moderate", "package": "jenkins-2-plugins-0:4.13.1684911916-1.el8", "product_name": "OCP-Tools-4.13-RHEL-8", "release_date": "2023-05-24T00:00:00Z"}, {"advisory": "RHSA-2023:6179", "cpe": "cpe:/a:redhat:ocp_tools:4.13::el8", "impact": "moderate", "package": "jenkins-2-plugins-0:4.13.1698292274-1.el8", "product_name": "OCP-Tools-4.13-RHEL-8", "release_date": "2023-10-30T00:00:00Z"}, {"advisory": "RHSA-2024:0776", "cpe": "cpe:/a:redhat:ocp_tools:4.13::el8", "impact": "moderate", "package": "jenkins-2-plugins-0:4.13.1706516346-1.el8", "product_name": "OCP-Tools-4.13-RHEL-8", "release_date": "2024-02-12T00:00:00Z"}, {"advisory": "RHSA-2023:7288", "cpe": "cpe:/a:redhat:ocp_tools:4.14::el8", "impact": "moderate", "package": "jenkins-2-plugins-0:4.14.1699356715-1.el8", "product_name": "OCP-Tools-4.14-RHEL-8", "release_date": "2023-11-16T00:00:00Z"}, {"advisory": "RHSA-2024:0777", "cpe": "cpe:/a:redhat:ocp_tools:4.14::el8", "impact": "moderate", "package": "jenkins-2-plugins-0:4.14.1706516441-1.el8", "product_name": "OCP-Tools-4.14-RHEL-8", "release_date": "2024-02-12T00:00:00Z"}, {"advisory": "RHSA-2023:3198", "cpe": "cpe:/a:redhat:ocp_tools:4.11::el8", "impact": "moderate", "package": "jenkins-2-plugins-0:4.11.1683009941-1.el8", "product_name": "OpenShift Developer Tools and Services for OCP 4.11", "release_date": "2023-05-17T00:00:00Z"}, {"advisory": "RHSA-2023:6171", "cpe": "cpe:/a:redhat:ocp_tools:4.11::el8", "impact": "moderate", "package": "jenkins-2-plugins-0:4.11.1698299029-1.el8", "product_name": "OpenShift Developer Tools and Services for OCP 4.11", "release_date": "2023-10-30T00:00:00Z"}, {"advisory": "RHSA-2024:0775", "cpe": "cpe:/a:redhat:ocp_tools:4.11::el8", "impact": "moderate", "package": "jenkins-2-plugins-0:4.11.1706516946-1.el8", "product_name": "OpenShift Developer Tools and Services for OCP 4.11", "release_date": "2024-02-12T00:00:00Z"}, {"advisory": "RHSA-2022:8876", "cpe": "cpe:/a:redhat:amq_broker:7", "impact": "moderate", "package": "commons-text", "product_name": "Red Hat AMQ Broker 7", "release_date": "2022-12-07T00:00:00Z"}, {"advisory": "RHSA-2024:3527", "cpe": "cpe:/a:redhat:amq_streams:2", "product_name": "Red Hat AMQ Streams 2.7.0", "release_date": "2024-05-30T00:00:00Z"}, {"advisory": "RHSA-2022:9023", "cpe": "cpe:/a:redhat:quarkus:2.13", "impact": "moderate", "package": "commons-text", "product_name": "Red Hat build of Quarkus 2.13.5", "release_date": "2022-12-14T00:00:00Z"}, {"advisory": "RHSA-2023:1006", "cpe": "cpe:/a:redhat:quarkus:2.7", "product_name": "Red Hat build of Quarkus 2.7.7", "release_date": "2023-03-08T00:00:00Z"}, {"advisory": "RHSA-2022:8652", "cpe": "cpe:/a:redhat:jboss_fuse:7", "impact": "moderate", "package": "commons-text", "product_name": "Red Hat Fuse 7.11.1", "release_date": "2022-11-28T00:00:00Z"}, {"advisory": "RHSA-2023:1655", "cpe": "cpe:/a:redhat:openshift:4.10::el8", "impact": "moderate", "package": "jenkins-2-plugins-0:4.10.1680703106-1.el8", "product_name": "Red Hat OpenShift Container Platform 4.10", "release_date": "2023-04-12T00:00:00Z"}, {"advisory": "RHSA-2023:1524", "cpe": "cpe:/a:redhat:openshift:4.9::el8", "impact": "moderate", "package": "jenkins-2-plugins-0:4.9.1680069756-1.el8", "product_name": "Red Hat OpenShift Container Platform 4.9", "release_date": "2023-04-05T00:00:00Z"}, {"advisory": "RHSA-2023:0261", "cpe": "cpe:/a:redhat:satellite:6.12::el8", "impact": "low", "package": "candlepin-0:4.1.18-1.el8sat", "product_name": "Red Hat Satellite 6.12 for RHEL 8", "release_date": "2023-01-18T00:00:00Z"}, {"advisory": "RHSA-2023:2097", "cpe": "cpe:/a:redhat:satellite:6.13::el8", "impact": "low", "package": "candlepin-0:4.2.13-1.el8sat", "product_name": "Red Hat Satellite 6.13 for RHEL 8", "release_date": "2023-05-03T00:00:00Z"}, {"advisory": "RHSA-2023:0469", "cpe": "cpe:/a:redhat:camel_quarkus:2.13", "impact": "low", "package": "commons-text", "product_name": "RHINT Camel-Q 2.13.2", "release_date": "2023-01-26T00:00:00Z"}, {"advisory": "RHSA-2022:8902", "cpe": "cpe:/a:redhat:camel_spring_boot:3.18.3", "impact": "moderate", "package": "commons-text", "product_name": "RHINT Camel-Springboot 3.18.3", "release_date": "2022-12-08T00:00:00Z"}, {"advisory": "RHSA-2023:2135", "cpe": "cpe:/a:redhat:jboss_enterprise_bpms_platform:7.13", "impact": "moderate", "package": "commons-text", "product_name": "RHPAM 7.13.1 async", "release_date": "2023-05-04T00:00:00Z"}], "bugzilla": {"description": "apache-commons-text: variable interpolation RCE", "id": "2135435", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135435"}, "csaw": false, "cvss3": {"cvss3_base_score": "9.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "verified"}, "cwe": "CWE-94->CWE-1188", "details": ["Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is \"${prefix:name}\", where \"prefix\" is used to locate an instance of org.apache.commons.text.lookup.StringLookup that performs the interpolation. Starting with version 1.5 and continuing through 1.9, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - \"script\" - execute expressions using the JVM script execution engine (javax.script) - \"dns\" - resolve dns records - \"url\" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Text 1.10.0, which disables the problematic interpolators by default.", "A flaw was found in Apache Commons Text packages 1.5 through 1.9. The affected versions allow an attacker to benefit from a variable interpolation process contained in Apache Commons Text, which can cause properties to be dynamically defined. Server applications are vulnerable to remote code execution (RCE) and unintentional contact with untrusted remote servers."], "mitigation": {"lang": "en:us", "value": "This flaw may be avoided by ensuring that any external inputs used with the Commons-Text lookup methods are sanitized properly. Untrusted input should always be thoroughly sanitized before using in any potentially risky situations."}, "name": "CVE-2022-42889", "package_state": [{"cpe": "cpe:/a:redhat:a_mq_clients:2", "fix_state": "Not affected", "package_name": "commons-text", "product_name": "A-MQ Clients 2"}, {"cpe": "cpe:/a:redhat:logging:5", "fix_state": "Not affected", "package_name": "openshift-logging/elasticsearch6-rhel8", "product_name": "Logging Subsystem for Red Hat OpenShift"}, {"cpe": "cpe:/a:redhat:amq_online:1", "fix_state": "Not affected", "package_name": "commons-text", "product_name": "Red Hat A-MQ Online"}, {"cpe": "cpe:/a:redhat:service_registry:2", "fix_state": "Not affected", "package_name": "commons-text", "product_name": "Red Hat build of Apicurio Registry"}, {"cpe": "cpe:/a:redhat:jboss_data_grid:8", "fix_state": "Not affected", "package_name": "commons-text", "product_name": "Red Hat Data Grid 8"}, {"cpe": "cpe:/a:redhat:integration:1", "fix_state": "Affected", "impact": "low", "package_name": "commons-text", "product_name": "Red Hat Integration Camel K"}, {"cpe": "cpe:/a:redhat:integration:1", "fix_state": "Not affected", "package_name": "commons-text", "product_name": "Red Hat Integration Change Data Capture"}, {"cpe": "cpe:/a:redhat:jboss_data_grid:7", "fix_state": "Not affected", "package_name": "commons-text", "product_name": "Red Hat JBoss Data Grid 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:6", "fix_state": "Not affected", "package_name": "commons-text", "product_name": "Red Hat JBoss Enterprise Application Platform 6"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7", "fix_state": "Not affected", "package_name": "commons-text", "product_name": "Red Hat JBoss Enterprise Application Platform 7"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Affected", "impact": "low", "package_name": "commons-text", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:5", "fix_state": "Not affected", "package_name": "commons-text", "product_name": "Red Hat JBoss Web Server 5"}, {"cpe": "cpe:/a:redhat:openshift:3.11", "fix_state": "Out of support scope", "impact": "moderate", "package_name": "jenkins-2-plugins", "product_name": "Red Hat OpenShift Container Platform 3.11"}, {"cpe": "cpe:/a:redhat:red_hat_single_sign_on:7", "fix_state": "Not affected", "package_name": "commons-text", "product_name": "Red Hat Single Sign-On 7"}, {"cpe": "cpe:/a:redhat:openshift_application_runtimes:1.0", "fix_state": "Not affected", "package_name": "commons-text", "product_name": "Red Hat support for Spring Boot"}, {"cpe": "cpe:/a:redhat:amq_streams:1", "fix_state": "Not affected", "package_name": "commons-text", "product_name": "streams for Apache Kafka"}], "public_date": "2022-10-13T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2022-42889\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-42889\nhttps://blogs.apache.org/security/entry/cve-2022-42889\nhttps://lists.apache.org/thread/n2bd4vdsgkqh2tm14l1wyc3jyol7s1om\nhttps://seclists.org/oss-sec/2022/q4/22"], "statement": "In order to carry successful exploitation of this vulnerability, the following conditions must be in place on the affected target:\n- Usage of specific methods that interpolate the variables as described in the flaw\n- Usage of external input for those methods\n- Usage of that external input has to be unsanitized/no \"allow list\"/etc.\nThe following products have *Low* impact because they have maven references to the affected package but do not ship it nor use the code:\n- Red Hat EAP Expansion Pack (EAP-XP)\n- Red Hat Camel-K\n- Red Hat Camel-Quarkus\nRed Hat Satellite ships Candlepin that embeds Apache Commons Text, however, it is not vulnerable to the flaw since the library has not been exposed in the product code. In Candlepin, the Commons Text is being pulled for the Liquibase and ActiveMQ Artemis libraries as a dependency. Red Hat Product Security has evaluated and rated the impact of the flaw as Low for Satellite since there was no harm identified to the confidentiality, integrity, or availability of systems.\n- The OCP has a *Moderate* impact because the affected library is a third-party library in the OCP jenkins-2-plugin component which reduces the possibilities of successful exploitation.\n- The OCP-4.8 is affected by this CVE and is in an extended life phase. For versions of products in the Extended Life Phase, Red Hat will provide limited ongoing technical support. No bug fixes, security fixes, hardware enablement or root-cause analysis will be available during this phase, and support will be provided on existing installations only.", "threat_severity": "Critical", "upstream_fix": "commons-text 1.10.0"}