Description
Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.StringLookup that performs the interpolation. Starting with version 1.5 and continuing through 1.9, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - "script" - execute expressions using the JVM script execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Text 1.10.0, which disables the problematic interpolators by default.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Commons Text | unspecified – ≤ 1.9, 1.5 – < Apache Commons Text* | Apache Commons Text* |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | commons-text | 1.10.0-1 | — |
| Debian 13 | commons-text | 1.10.0-1 | — |
| Debian 12 | commons-text | 1.10.0-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | commons-text | No fix yet | — |
| Ubuntu 20.04 LTS | commons-text | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Satellite Utils 6 | foreman +1 | 3.3.0.18-1.el8sat | RHSA-2023:0261 |
| Red Hat Satellite Utils 6 | satellite +1 | 6.12.1-1.el8sat | RHSA-2023:0261 |
| Red Hat Satellite Maintenance 6 | satellite-clone | 3.2.0-2.el8sat | RHSA-2023:0261 |
| Red Hat Satellite Capsule 6 | ansible-collection-redhat-satellite | 3.9.0-2.el8sat | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | ansible-collection-redhat-satellite_operations | 1.3.0-2.el8sat | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | ansible-lint | 5.0.8-4.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | ansible-runner +1 | 2.2.1-3.el8sat | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | ansiblerole-foreman_scap_client | 0.2.0-2.el8sat | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | ansiblerole-insights-client | 1.7.1-2.el8sat | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | cjson | 1.7.14-5.el8sat | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | createrepo_c +3 | 0.20.1-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | dynflow-utils | 1.6.3-1.el8sat | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | foreman +1 | 3.3.0.18-1.el8sat | RHSA-2023:2097, RHSA-2023:0261 |
| Red Hat Satellite Capsule 6 | foreman-bootloaders-redhat +1 | 202102220000-1.el8sat | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | foreman-discovery-image | 1:4.1.0-10.el8sat | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | foreman-discovery-image-service +1 | 1.0.0-4.1.el8sat | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | foreman-installer +1 | 1:3.5.2.1-1.el8sat | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | foreman-proxy +1 | 3.5.1-1.el8sat | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | katello +3 | 4.7.0-1.el8sat | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | katello-certs-tools | 2.9.0-1.el8sat | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | katello-client-bootstrap | 1.7.9-1.el8sat | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | libcomps +2 | 0.1.18-4.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | libdb-cxx | 5.3.28-42.el8_4 | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | libsodium | 1.0.17-3.el8sat | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | libsolv +2 | 0.7.22-4.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | libwebsockets | 2.4.2-2.el8 | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | mosquitto | 2.0.14-1.el8sat | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | pulpcore-selinux | 1.3.2-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | puppet-agent | 7.12.1-1.el8sat | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | puppet-agent-oauth | 0.5.10-1.el8sat | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | puppet-foreman_scap_client | 0.4.0-1.el8sat | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | puppetlabs-stdlib | 5.2.0-1.el8sat | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | puppetserver | 7.9.3-1.el8sat | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-aiodns +1 | 3.0.0-3.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-aiofiles +1 | 22.1.0-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-aiohttp +1 | 3.8.1-3.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-aiohttp-xmlrpc +1 | 1.5.0-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-aioredis +1 | 2.0.1-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-aiosignal +1 | 1.2.0-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-ansible-builder +1 | 1.0.1-4.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-asgiref +1 | 3.5.2-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-async-lru +1 | 1.0.3-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-async-timeout +1 | 4.0.2-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-asyncio-throttle +1 | 1.0.2-3.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-attrs +1 | 21.4.0-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-backoff +1 | 2.1.2-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-bindep +1 | 2.11.0-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-bleach +1 | 3.3.1-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-bleach-allowlist +1 | 1.0.3-3.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-bracex +1 | 2.2.1-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-brotli +1 | 1.0.9-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-cchardet +1 | 2.1.7-4.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-certifi +1 | 2020.6.20-3.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-cffi +1 | 1.15.1-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-chardet +1 | 5.0.0-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-charset-normalizer +1 | 2.1.1-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-click +1 | 8.1.3-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-click-shell +1 | 2.1-3.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-colorama +1 | 0.4.4-3.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-commonmark +1 | 0.9.1-5.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-contextlib2 +1 | 21.6.0-3.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-cryptography +1 | 3.4.8-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-daemon +1 | 2.3.1-1.1.el8sat | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-dataclasses +1 | 0.8-3.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-dateutil +1 | 2.8.2-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-debian +1 | 0.1.43-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-defusedxml +1 | 0.7.1-3.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-deprecated +1 | 1.2.13-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-diff-match-patch +1 | 20200713-3.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-distro +1 | 1.7.0-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-django +1 | 3.2.18-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-django-currentuser +1 | 0.5.3-5.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-django-filter +1 | 22.1-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-django-guid +1 | 3.3.0-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-django-import-export +1 | 2.8.0-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-django-lifecycle +1 | 1.0.0-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-djangorestframework +1 | 3.13.1-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-djangorestframework-queryfields +1 | 1.0.0-5.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-docutils +1 | 0.19-1.1.el8sat | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-drf-access-policy +1 | 1.1.2-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-drf-nested-routers +1 | 0.93.4-3.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-drf-spectacular +1 | 0.23.1-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-dynaconf +1 | 3.1.9-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-ecdsa +1 | 0.14.1-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-enrich +1 | 1.2.6-5.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-et-xmlfile +1 | 1.1.0-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-flake8 +1 | 3.9.2-5.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-frozenlist +1 | 1.3.0-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-future +1 | 0.18.2-5.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-galaxy-importer +1 | 0.4.5-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-gitdb +1 | 4.0.9-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-gitpython +1 | 3.1.26-3.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-gnupg +1 | 0.5.0-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-gunicorn +1 | 20.1.0-5.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-idna +1 | 3.3-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-idna-ssl +1 | 1.1.0-5.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-importlib-metadata +1 | 4.10.1-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-inflection +3 | 0.5.1-3.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-iniparse +1 | 0.4-35.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-jinja2 +1 | 3.1.2-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-jsonschema +1 | 4.9.1-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-lockfile +1 | 0.12.2-1.el8sat | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-lxml +1 | 4.7.1-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-markdown +1 | 3.3.6-3.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-markuppy +1 | 1.14-3.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-markupsafe +1 | 2.0.1-3.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-mccabe +1 | 0.6.1-3.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-multidict +1 | 6.0.2-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-naya +3 | 1.1.1-3.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-odfpy +1 | 1.4.1-6.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-openpyxl +1 | 3.0.9-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-packaging +1 | 21.3-1.1.el8sat | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-parsley +1 | 1.3-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-pbr +1 | 5.8.0-4.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-pexpect +1 | 4.8.0-2.el8sat | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-productmd +1 | 1.33-3.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-protobuf +1 | 4.21.6-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-psycopg2 +1 | 2.9.3-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-ptyprocess +1 | 0.7.0-1.el8sat | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-pulp-ansible +1 | 1:0.15.0-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-pulp-certguard +1 | 1.5.5-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-pulp-cli +1 | 0.14.0-4.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-pulp-container +1 | 2.10.10-1.el8pc | RHSA-2023:2097, RHSA-2023:0261 |
| Red Hat Satellite Capsule 6 | python-pulp-deb +1 | 2.20.0-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-pulp-file +1 | 1.11.1-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-pulp-rpm +1 | 3.18.9-1.el8pc | RHSA-2023:2097, RHSA-2023:0261 |
| Red Hat Satellite Capsule 6 | python-pulpcore +1 | 3.18.11-1.el8pc | RHSA-2023:2097, RHSA-2023:0261 |
| Red Hat Satellite Capsule 6 | python-pyOpenSSL +1 | 19.1.0-3.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-pycairo +1 | 1.20.1-3.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-pycares +1 | 4.1.2-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-pycodestyle +1 | 2.7.0-5.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-pycparser +1 | 2.21-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-pycryptodomex +1 | 3.14.1-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-pyflakes +1 | 2.3.1-5.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-pygments +1 | 2.11.2-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-pygobject +1 | 1:3.40.1-4.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-pygtrie +1 | 2.5.0-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-pyjwkest +1 | 1.4.2-6.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-pyjwt +1 | 2.5.0-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-pyparsing +1 | 2.4.7-3.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-pyrsistent +1 | 0.18.1-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-pytz +1 | 2022.2.1-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-pyyaml +1 | 5.4.1-4.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-qpid +1 | 1.37.0-1.el8 | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-redis +1 | 4.3.4-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-requests +1 | 2.28.1-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-requirements-parser +1 | 0.2.0-3.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-rhsm +1 | 1.19.2-3.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-rich +1 | 10.12.0-3.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-ruamel-yaml +1 | 0.17.20-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-ruamel-yaml-clib +1 | 0.2.6-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-schema +1 | 0.7.5-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-semantic-version +1 | 2.10.0-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-six +1 | 1.16.0-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-smmap +1 | 5.0.0-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-sqlparse +1 | 0.4.2-3.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-tablib +1 | 3.2.0-3.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-tenacity +1 | 7.0.0-3.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-toml +1 | 0.10.2-3.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-types-cryptography +1 | 3.3.23-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-typing-extensions +1 | 3.10.0.2-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-uritemplate +1 | 4.1.1-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-url-normalize +1 | 1.4.3-4.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-urllib3 +1 | 1.26.8-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-urlman +1 | 2.0.1-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-wcmatch +1 | 8.3-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-whitenoise +1 | 6.0.0-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-wrapt +1 | 1.14.1-1.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-xlrd +1 | 2.0.1-5.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-xlwt +1 | 1.3.0-3.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-yarl | 1.7.2-2.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python-zipp | 3.4.0-4.el8pc | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python2-qpid-qmf | 1.39.0-7.el8amq | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python2-saslwrapper | 0.22-6.el8sat | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | python3-qpid-proton | 0.33.0-4.el8 | RHSA-2023:2097 |
| Red Hat Satellite Capsule 6 | rubygem-smart_proxy_container_gateway | 1.0.7-1.el8sat | RHSA-2023:0261 |
| Red Hat Satellite Capsule 6 | satellite +2 | 6.12.1-1.el8sat | RHSA-2023:0261 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Satellite 6 | candlepin +1 | 4.1.18-1.el8sat | RHSA-2023:0261 |
| Red Hat Satellite 6 | foreman +13 | 3.3.0.18-1.el8sat | RHSA-2023:0261 |
| Red Hat Satellite 6 | python-pulp-container +1 | 2.10.10-1.el8pc | RHSA-2023:0261 |
| Red Hat Satellite 6 | python-pulp-rpm +1 | 3.18.9-1.el8pc | RHSA-2023:0261 |
| Red Hat Satellite 6 | python-pulpcore +1 | 3.18.11-1.el8pc | RHSA-2023:0261 |
| Red Hat Satellite 6 | rubygem-activesupport | 6.0.6-1.el8sat | RHSA-2023:0261 |
| Red Hat Satellite 6 | rubygem-foreman_rh_cloud | 6.0.44-1.el8sat | RHSA-2023:0261 |
| Red Hat Satellite 6 | rubygem-foreman_webhooks | 3.0.5-1.1.el8sat | RHSA-2023:0261 |
| Red Hat Satellite 6 | rubygem-katello | 4.5.0.22-1.el8sat | RHSA-2023:0261 |
| Red Hat Satellite 6 | rubygem-rails +11 | 6.0.6-2.el8sat | RHSA-2023:0261 |
| Red Hat Satellite 6 | rubygem-smart_proxy_container_gateway | 1.0.7-1.el8sat | RHSA-2023:0261 |
| Red Hat Satellite 6 | satellite +2 | 6.12.1-1.el8sat | RHSA-2023:0261 |
| Red Hat OpenShift 4 | haproxy +1 | 2.2.19-4.el8 | RHSA-2023:1655 |
| Red Hat OpenShift 4 | jenkins | 2.387.1.1680701869-1.el8 | RHSA-2023:1655 |
| Red Hat OpenShift 4 | jenkins-2-plugins | 4.9.1680069756-1.el8 | RHSA-2023:1655, RHSA-2023:1524 |
| Red Hat OpenShift 4 | openshift +1 | 4.10.0-202303221742.p0.g16bcd69.assembly.stream.el7 | RHSA-2023:1655 |
| Red Hat Ocp Tools 4 | jenkins | 2.387.1.1683009763-3.el8 | RHSA-2024:0778, RHSA-2024:0777, RHSA-2024:0776 |
| Red Hat Ocp Tools 4 | jenkins-2-plugins | 4.11.1683009941-1.el8 | RHSA-2024:0778, RHSA-2024:0777, RHSA-2024:0776 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-apache-cxf +3 | 3.1.16-4.redhat_00003.1.ep7.el7 | RHSA-2025:1746 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-hal-console | 3.2.17-1.Final_redhat_00001.1.el7eap | RHSA-2025:1747 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jackson-core +7 | 2.10.4-2.redhat_00004.1.el7eap | RHSA-2025:1747 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jackson-databind | 2.8.11.6-2.SP1_redhat_00002.1.ep7.el7 | RHSA-2025:1747, RHSA-2025:1746 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jackson-modules-base +1 | 2.10.4-4.redhat_00004.1.el7eap | RHSA-2025:1747 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jettison | 1.3.8-2.redhat_00002.1.ep7.el7 | RHSA-2025:1747, RHSA-2025:1746 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-netty +1 | 4.1.63-1.Final_redhat_00002.1.ep7.el7 | RHSA-2025:1747, RHSA-2025:1746 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-resteasy +16 | 3.0.27-1.Final_redhat_00001.1.ep7.el7 | RHSA-2025:1747, RHSA-2025:1746 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-resteasy-rxjava2 +2 | 3.11.6-1.Final_redhat_00001.1.el7eap | RHSA-2025:1747 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-snakeyaml | 1.33.0-1.SP1_redhat_00001.1.el7eap | RHSA-2025:1747, RHSA-2025:1746 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-velocity | 1.7.0-3.redhat_00006.1.ep7.el7 | RHSA-2025:1746 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly +1 | 7.1.9-2.GA_redhat_00002.1.ep7.el7 | RHSA-2025:1747, RHSA-2025:1746 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly-javadocs +2 | 7.3.12-3.GA_redhat_00002.1.el7eap | RHSA-2025:1747 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | apache-commons-text | 1.10.0-1.1 | openSUSE-SU-2024:12409-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
Apache Commons Text RCE
exploit/multi/http/apache_commons_text4shell
Exploit-DB 1
- Apache Commons Text 1.10.0 - Remote Code Execution EDB-52261 · webapps · Apr 18, 2025
GitHub 51 repositories · most starred shown
-
karthikuj/cve-2022-42889-text4shell-docker ★ 76 · Oct 18, 2022
Dockerized POC for CVE-2022-42889 Text4Shell
-
kljunowsky/CVE-2022-42889-text4shell ★ 57 · Oct 19, 2022
Apache commons text - CVE-2022-42889 Text4Shell proof of concept exploit.
-
ClickCyber/cve-2022-42889 ★ 40 · Oct 18, 2022
cve-2022-42889 Text4Shell CVE-2022-42889 affects Apache Commons Text versions 1.5 through 1.9. It has been patched as of Commons Text version 1.10.
-
SeanWrightSec/CVE-2022-42889-PoC ★ 35 · Oct 17, 2022
Proof of Concept for the Apache commons-text vulnerability CVE-2022-42889.
-
f0ng/text4shellburpscanner ★ 20 · Dec 9, 2022
text4shell(CVE-2022-42889) BurpSuite Scanner
-
cxzero/CVE-2022-42889-text4shell ★ 20 · Oct 23, 2022
CVE-2022-42889 aka Text4Shell research & PoC
-
cryxnet/CVE-2022-42889-RCE ★ 15 · Nov 4, 2022
Proof of Concept for CVE-2022-42889 (Text4Shell Vulnerability)
-
alealeluyah/CVE-2022-42889-Text4Shell-POC ★ 13 · Jun 27, 2023
This repository contains a Python script to automate the process of testing for a vulnerability known as Text4Shell, referenced under the CVE id: CVE-2022-42889.
-
korteke/CVE-2022-42889-POC ★ 10 · Oct 18, 2022
A simple application that shows how to exploit the CVE-2022-42889 vulnerability
-
securekomodo/text4shell-poc ★ 8 · Oct 20, 2022
Proof of Concept Appliction for testing CVE-2022-42889
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.guicedee.services:commons-text | <= 1.2.2.1-jre17 | — | GHSA-599f-7c49-w659 |
| Maven | org.apache.commons:commons-text | >= 1.5, < 1.10.0 | 1.10.0 | GHSA-599f-7c49-w659 |
Advisories 33
- RHSA-2024:0777 Red Hat Security Advisory: jenkins and jenkins-2-plugins security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2023:7288 Red Hat Security Advisory: Red Hat Product OCP Tools 4.14 Openshift Jenkins security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2023:6179 Red Hat Security Advisory: Red Hat Product OCP Tools 4.13 OpenShift Jenkins security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2023:6172 Red Hat Security Advisory: Red Hat Product OCP Tools 4.12 Openshift Jenkins security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2023:6171 Red Hat Security Advisory: Red Hat Product OCP Tools 4.11 Openshift Jenkins security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2025:1747 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.12 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2025:1746 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.9 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2024:0778 Red Hat Security Advisory: Jenkins and Jenkins-2-plugins security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2023:3299 Red Hat Security Advisory: jenkins and jenkins-2-plugins security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2023:2097 Red Hat Security Advisory: Satellite 6.13 Release Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2023:0261 Red Hat Security Advisory: Satellite 6.12.1 Async Security Update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2023:3198 Red Hat Security Advisory: jenkins and jenkins-2-plugins security update Red Hat Security Advisories (RHSA) · Oct 8, 2026
- RHSA-2024:0776 Red Hat Security Advisory: jenkins and jenkins-2-plugins security update Red Hat Security Advisories (RHSA) · Oct 2, 2026
- RHSA-2024:0775 Red Hat Security Advisory: jenkins and jenkins-2-plugins security update Red Hat Security Advisories (RHSA) · Oct 2, 2026
- RHSA-2023:3195 Red Hat Security Advisory: jenkins and jenkins-2-plugins security update Red Hat Security Advisories (RHSA) · Oct 2, 2026
- RHSA-2023:1655 Red Hat Security Advisory: OpenShift Container Platform 4.10.56 security update Red Hat Security Advisories (RHSA) · Oct 2, 2026
- RHSA-2023:1524 Red Hat Security Advisory: OpenShift Container Platform 4.9.59 security update Red Hat Security Advisories (RHSA) · Oct 2, 2026
- WID-SEC-2024-0794 Dell ECS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- WID-SEC-2023-1143 Red Hat Satellite: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 16, 2026
- openSUSE-SU-2024:12409-1 apache-commons-text-1.10.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2023-0395 Splunk Splunk Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 18, 2025
- WID-SEC-2023-0138 Oracle Communications Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 15, 2025
- WID-SEC-2022-1758 Apache Commons Text: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Feb 23, 2025
- WID-SEC-2023-0137 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 21, 2024
- WID-SEC-2022-2290 SAP Patchday Dezember 2022 BSI CERT-Bund (WID) · May 31, 2023
- WID-SEC-2023-0132 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 1, 2023
- WID-SEC-2023-1031 Oracle Retail Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 18, 2023
- WID-SEC-2023-1017 Oracle Financial Services Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 18, 2023
- WID-SEC-2023-0136 Oracle Construction and Engineering: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 17, 2023
- WID-SEC-2023-0134 Oracle Enterprise Manager: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 17, 2023
- WID-SEC-2023-0130 Oracle Hyperion: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 17, 2023
- WID-SEC-2023-0127 Oracle JD Edwards: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 17, 2023
- WID-SEC-2023-0119 Oracle Utilities Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 17, 2023
References
- https://lists.apache.org/thread/n2bd4vdsgkqh2tm14l1wyc3jyol7s1om
- [oss-security] 20221013 CVE-2022-42889: Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults mailing-list
- [oss-security] 20221017 Re: CVE-2022-42889: Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults mailing-list
- https://security.netapp.com/advisory/ntap-20221020-0004/
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0022
- GLSA-202301-05 vendor-advisory
- 20230214 OXAS-ADV-2022-0002: OX App Suite Security Advisory mailing-list
- http://packetstormsecurity.com/files/171003/OX-App-Suite-Cross-Site-Scripting-Server-Side-Request-Forgery.html
- http://packetstormsecurity.com/files/176650/Apache-Commons-Text-1.9-Remote-Code-Execution.html