Apache Commons: Mehrere Schwachstellen ermöglichen Offenlegung von Informationen

Summary

Product

Vulnerabilities 2

• High 7.5
  CVE-2025-27553

  Apache Commons VFS: Possible path traversal issue when using NameScope.DESCENDENT

  Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0. The FileObject API in Commons VFS has a 'resolveFile' method that takes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that "an exception is thrown if the resolved fil…

  Apache Software Foundation Apache Commons VFS org.apache.commons:commons-vfs2 commons-vfs Debian Ubuntu Maven
  Mar 23, 2025
• Medium 5.0
  CVE-2025-30474

  Apache Commons VFS: Failing to find an FTP file can reveal the URI's password in an error message

  Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Commons VFS. The FtpFileObject class can throw an exception when a file is not found, revealing the original URI in its message, which may include a password. The fix is to mas…

  Apache Software Foundation Apache Commons VFS commons-vfs org.apache.commons:commons-vfs2 Debian Ubuntu Maven
  Mar 23, 2025

Revision history

1. 2025-07-23 #8

   Neue Updates von Oracle Linux aufgenommen

2. 2025-07-07 #7

   Neue Updates von Red Hat aufgenommen

3. 2025-05-01 #6

   Neue Updates von Amazon aufgenommen

4. 2025-04-16 #5

   Neue Updates von Amazon aufgenommen

5. 2025-04-02 #4

   Neue Updates von Debian aufgenommen

6. 2025-03-27 #3

   Neue Updates von openSUSE aufgenommen

7. 2025-03-26 #2

   Neue Updates von SUSE aufgenommen

8. 2025-03-23 #1

   Initiale Fassung

References

• Red Hat Bugtracker #2354334 vom 2025-03-23
  https://bugzilla.redhat.com/show_bug.cgi?id=2354334
• Red Hat Bugtracker #2354335 vom 2025-03-23
  https://bugzilla.redhat.com/show_bug.cgi?id=2354335
• GitHub Security Advisory GHSA-3936-3gx6-49c4 vom 2025-03-23
  https://github.com/advisories/GHSA-3936-3gx6-49c4
• SUSE Security Update SUSE-SU-2025:1022-1 vom 2025-03-26
  https://lists.suse.com/pipermail/sle-security-updates/2025-March/020604.html
• openSUSE Security Update OPENSUSE-SU-2025:14929-1 vom 2025-03-27
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/TJEKF3EWGBGJVNKZDARY564OGCSKZCWT/
• openSUSE Security Update OPENSUSE-SU-2025:14929-1 vom 2025-03-27
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/TJEKF3EWGBGJVNKZDARY564OGCSKZCWT/
• Debian Security Advisory DLA-4111 vom 2025-04-02
  https://lists.debian.org/debian-lts-announce/2025/04/msg00006.html
• Amazon Linux Security Advisory ALAS-2025-2819 vom 2025-04-16
  https://alas.aws.amazon.com/AL2/ALAS-2025-2819.html
• Amazon Linux Security Advisory ALAS-2025-2842 vom 2025-04-30
  https://alas.aws.amazon.com/AL2/ALAS-2025-2842.html
• Red Hat Security Advisory RHSA-2025:10548 vom 2025-07-08
  https://access.redhat.com/errata/RHSA-2025:10548
• Oracle Linux Security Advisory ELSA-2025-10548 vom 2025-07-24
  https://linux.oracle.com/errata/ELSA-2025-10548.html