Description
Apache Commons Configuration performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.configuration2.interpol.Lookup that performs the interpolation. Starting with version 2.4 and continuing through 2.7, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - "script" - execute expressions using the JVM script execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Configuration 2.8.0, which disables the problematic interpolators by default.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Commons Configuration | Apache Commons Configuration – < 2.8.0 | 2.8.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | commons-configuration2 | 2.8.0-1 | — |
| Debian 13 | commons-configuration2 | 2.8.0-1 | — |
| Debian 12 | commons-configuration2 | 2.8.0-1 | — |
| Debian 11 | commons-configuration2 | 2.8.0-1~deb11u1 | DSA-5290-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | commons-configuration2 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Satellite Capsule 6 | ansible-collection-redhat-satellite | 3.9.0-2.el8sat | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | ansible-collection-redhat-satellite_operations | 1.3.0-2.el8sat | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | ansible-lint | 5.0.8-4.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | ansible-runner +1 | 2.2.1-3.el8sat | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | ansiblerole-foreman_scap_client | 0.2.0-2.el8sat | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | ansiblerole-insights-client | 1.7.1-2.el8sat | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | cjson | 1.7.14-5.el8sat | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | createrepo_c +3 | 0.20.1-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | dynflow-utils | 1.6.3-1.el8sat | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | foreman +1 | 3.5.1.14-1.el8sat | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | foreman-bootloaders-redhat +1 | 202102220000-1.el8sat | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | foreman-discovery-image | 1:4.1.0-10.el8sat | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | foreman-discovery-image-service +1 | 1.0.0-4.1.el8sat | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | foreman-installer +1 | 1:3.5.2.1-1.el8sat | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | foreman-proxy +1 | 3.5.1-1.el8sat | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | katello +3 | 4.7.0-1.el8sat | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | katello-certs-tools | 2.9.0-1.el8sat | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | katello-client-bootstrap | 1.7.9-1.el8sat | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | libcomps +2 | 0.1.18-4.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | libdb-cxx | 5.3.28-42.el8_4 | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | libsodium | 1.0.17-3.el8sat | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | libsolv +2 | 0.7.22-4.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | libwebsockets | 2.4.2-2.el8 | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | mosquitto | 2.0.14-1.el8sat | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | pulpcore-selinux | 1.3.2-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | puppet-agent | 7.12.1-1.el8sat | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | puppet-agent-oauth | 0.5.10-1.el8sat | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | puppet-foreman_scap_client | 0.4.0-1.el8sat | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | puppetlabs-stdlib | 5.2.0-1.el8sat | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | puppetserver | 7.9.3-1.el8sat | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-aiodns +1 | 3.0.0-3.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-aiofiles +1 | 22.1.0-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-aiohttp +1 | 3.8.1-3.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-aiohttp-xmlrpc +1 | 1.5.0-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-aioredis +1 | 2.0.1-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-aiosignal +1 | 1.2.0-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-ansible-builder +1 | 1.0.1-4.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-asgiref +1 | 3.5.2-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-async-lru +1 | 1.0.3-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-async-timeout +1 | 4.0.2-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-asyncio-throttle +1 | 1.0.2-3.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-attrs +1 | 21.4.0-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-backoff +1 | 2.1.2-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-bindep +1 | 2.11.0-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-bleach +1 | 3.3.1-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-bleach-allowlist +1 | 1.0.3-3.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-bracex +1 | 2.2.1-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-brotli +1 | 1.0.9-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-cchardet +1 | 2.1.7-4.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-certifi +1 | 2020.6.20-3.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-cffi +1 | 1.15.1-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-chardet +1 | 5.0.0-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-charset-normalizer +1 | 2.1.1-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-click +1 | 8.1.3-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-click-shell +1 | 2.1-3.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-colorama +1 | 0.4.4-3.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-commonmark +1 | 0.9.1-5.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-contextlib2 +1 | 21.6.0-3.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-cryptography +1 | 3.4.8-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-daemon +1 | 2.3.1-1.1.el8sat | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-dataclasses +1 | 0.8-3.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-dateutil +1 | 2.8.2-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-debian +1 | 0.1.43-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-defusedxml +1 | 0.7.1-3.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-deprecated +1 | 1.2.13-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-diff-match-patch +1 | 20200713-3.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-distro +1 | 1.7.0-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-django +1 | 3.2.18-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-django-currentuser +1 | 0.5.3-5.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-django-filter +1 | 22.1-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-django-guid +1 | 3.3.0-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-django-import-export +1 | 2.8.0-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-django-lifecycle +1 | 1.0.0-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-djangorestframework +1 | 3.13.1-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-djangorestframework-queryfields +1 | 1.0.0-5.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-docutils +1 | 0.19-1.1.el8sat | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-drf-access-policy +1 | 1.1.2-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-drf-nested-routers +1 | 0.93.4-3.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-drf-spectacular +1 | 0.23.1-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-dynaconf +1 | 3.1.9-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-ecdsa +1 | 0.14.1-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-enrich +1 | 1.2.6-5.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-et-xmlfile +1 | 1.1.0-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-flake8 +1 | 3.9.2-5.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-frozenlist +1 | 1.3.0-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-future +1 | 0.18.2-5.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-galaxy-importer +1 | 0.4.5-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-gitdb +1 | 4.0.9-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-gitpython +1 | 3.1.26-3.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-gnupg +1 | 0.5.0-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-gunicorn +1 | 20.1.0-5.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-idna +1 | 3.3-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-idna-ssl +1 | 1.1.0-5.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-importlib-metadata +1 | 4.10.1-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-inflection +3 | 0.5.1-3.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-iniparse +1 | 0.4-35.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-jinja2 +1 | 3.1.2-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-jsonschema +1 | 4.9.1-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-lockfile +1 | 0.12.2-1.el8sat | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-lxml +1 | 4.7.1-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-markdown +1 | 3.3.6-3.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-markuppy +1 | 1.14-3.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-markupsafe +1 | 2.0.1-3.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-mccabe +1 | 0.6.1-3.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-multidict +1 | 6.0.2-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-naya +3 | 1.1.1-3.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-odfpy +1 | 1.4.1-6.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-openpyxl +1 | 3.0.9-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-packaging +1 | 21.3-1.1.el8sat | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-parsley +1 | 1.3-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-pbr +1 | 5.8.0-4.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-pexpect +1 | 4.8.0-2.el8sat | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-productmd +1 | 1.33-3.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-protobuf +1 | 4.21.6-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-psycopg2 +1 | 2.9.3-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-ptyprocess +1 | 0.7.0-1.el8sat | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-pulp-ansible +1 | 1:0.15.0-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-pulp-certguard +1 | 1.5.5-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-pulp-cli +1 | 0.14.0-4.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-pulp-container +1 | 2.14.3-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-pulp-deb +1 | 2.20.0-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-pulp-file +1 | 1.11.1-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-pulp-rpm +1 | 3.18.11-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-pulpcore +1 | 3.21.6-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-pyOpenSSL +1 | 19.1.0-3.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-pycairo +1 | 1.20.1-3.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-pycares +1 | 4.1.2-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-pycodestyle +1 | 2.7.0-5.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-pycparser +1 | 2.21-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-pycryptodomex +1 | 3.14.1-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-pyflakes +1 | 2.3.1-5.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-pygments +1 | 2.11.2-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-pygobject +1 | 1:3.40.1-4.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-pygtrie +1 | 2.5.0-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-pyjwkest +1 | 1.4.2-6.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-pyjwt +1 | 2.5.0-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-pyparsing +1 | 2.4.7-3.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-pyrsistent +1 | 0.18.1-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-pytz +1 | 2022.2.1-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-pyyaml +1 | 5.4.1-4.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-qpid +1 | 1.37.0-1.el8 | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-redis +1 | 4.3.4-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-requests +1 | 2.28.1-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-requirements-parser +1 | 0.2.0-3.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-rhsm +1 | 1.19.2-3.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-rich +1 | 10.12.0-3.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-ruamel-yaml +1 | 0.17.20-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-ruamel-yaml-clib +1 | 0.2.6-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-schema +1 | 0.7.5-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-semantic-version +1 | 2.10.0-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-six +1 | 1.16.0-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-smmap +1 | 5.0.0-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-sqlparse +1 | 0.4.2-3.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-tablib +1 | 3.2.0-3.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-tenacity +1 | 7.0.0-3.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-toml +1 | 0.10.2-3.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-types-cryptography +1 | 3.3.23-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-typing-extensions +1 | 3.10.0.2-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-uritemplate +1 | 4.1.1-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-url-normalize +1 | 1.4.3-4.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-urllib3 +1 | 1.26.8-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-urlman +1 | 2.0.1-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-wcmatch +1 | 8.3-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-whitenoise +1 | 6.0.0-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-wrapt +1 | 1.14.1-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-xlrd +1 | 2.0.1-5.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-xlwt +1 | 1.3.0-3.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-yarl | 1.7.2-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-zipp | 3.4.0-4.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python2-qpid-qmf | 1.39.0-7.el8amq | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python2-saslwrapper | 0.22-6.el8sat | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python3-qpid-proton | 0.33.0-4.el8 | RHSA-2023:2097 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | apache-commons-configuration2 | 2.9.0-1.1 | openSUSE-SU-2024:13259-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 5 repositories
-
tangxiaofeng7/CVE-2022-33980-Apache-Commons-Configuration-RCE ★ 43 · Jul 8, 2022
CVE-2022-33980 Apache Commons Configuration 远程命令执行漏洞
-
HKirito/CVE-2022-33980 ★ 30 · Aug 10, 2022
CVE
-
sammwyy/CVE-2022-33980-POC ★ 5 · Oct 17, 2022
POC for CVE-2022-33980 (Apache Commons Configuration RCE vulnerability)
-
joseluisinigo/riskootext4shell ★ 1 · Jul 18, 2023
text4shell script for text coomons < =1.10 CVE-2022-33980
-
P0lar1ght/CVE-2022-33980-POC ★ 0 · Dec 22, 2022
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.commons:commons-configuration2 | >= 2.4, < 2.8.0 | 2.8.0 | GHSA-xj57-8qj4-c4m6 |
Advisories 11
- RHSA-2023:2097 Red Hat Security Advisory: Satellite 6.13 Release Red Hat Security Advisories (RHSA) · Oct 13, 2026
- WID-SEC-2023-1143 Red Hat Satellite: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 16, 2026
- DSA-5290-1 commons-configuration2 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:13259-1 apache-commons-configuration2-2.9.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2023-0138 Oracle Communications Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 15, 2025
- WID-SEC-2022-0590 Apache Commons: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Oct 14, 2024
- WID-SEC-2023-1016 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 26, 2023
- WID-SEC-2023-2675 Oracle Financial Services Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 17, 2023
- WID-SEC-2023-1031 Oracle Retail Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 18, 2023
- WID-SEC-2022-2056 Jenkins: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 22, 2023
- WID-SEC-2023-0133 Oracle Financial Services Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 17, 2023
References
- https://lists.apache.org/thread/tdf5n7j80lfxdhs2764vn0xmpfodm87s
- [oss-security] 20220706 CVE-2022-33980: Apache Commons Configuration insecure interpolation defaults mailing-list
- https://security.netapp.com/advisory/ntap-20221028-0015/
- [oss-security] 20221115 Multiple vulnerabilities in Jenkins plugins mailing-list
- DSA-5290 vendor-advisory