You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@commons.apache.org by gg...@apache.org on 2022/10/19 18:27:23 UTC
[commons-configuration] branch release updated (59e51527 -> e9ba4d6a)
This is an automated email from the ASF dual-hosted git repository.
ggregory pushed a change to branch release
in repository https://gitbox.apache.org/repos/asf/commons-configuration.git
from 59e51527 merging doc updates from master
new 83b49231 Add a security page
new 7dcb0b64 Simplify security page.
new 6634e784 Simplify security page.
new e9ba4d6a Add more detailed statement around CVE-2022-33980 (#230)
The 4 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
src/site/site.xml | 2 +-
src/site/xdoc/security.xml | 115 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 116 insertions(+), 1 deletion(-)
create mode 100644 src/site/xdoc/security.xml
[commons-configuration] 04/04: Add more detailed statement around CVE-2022-33980 (#230)
Posted by gg...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
ggregory pushed a commit to branch release
in repository https://gitbox.apache.org/repos/asf/commons-configuration.git
commit e9ba4d6a811c6620ca10c0236e1dd296062ecd37
Author: Arnout Engelen <ar...@engelen.eu>
AuthorDate: Wed Oct 19 18:34:37 2022 +0200
Add more detailed statement around CVE-2022-33980 (#230)
---
src/site/xdoc/security.xml | 79 ++++++++++++++++++++++++++++++++++++++++------
1 file changed, 70 insertions(+), 9 deletions(-)
diff --git a/src/site/xdoc/security.xml b/src/site/xdoc/security.xml
index bcaef141..366a7dc5 100644
--- a/src/site/xdoc/security.xml
+++ b/src/site/xdoc/security.xml
@@ -40,15 +40,76 @@
Team. Thank you.
</p>
- <subsection name="Fixed in Apache Commons Configuration 2.8.0">
- <ul>
- <li>
- <a href="https://nvd.nist.gov/vuln/detail/CVE-2022-33980">CVE-2022-33980</a>
- Variable interpolation can cause arbitrary code execution.
- </li>
- </ul>
-
- </subsection>
+ <subsection name="CVE-2022-33980 prior to 2.8.0, RCE when applied to untrusted input">
+ <p>
+ On 2022-07-06, the Apache Commons Configuration team disclosed
+ <a href="https://www.cve.org/CVERecord?id=CVE-2022-33980">CVE-2022-33980</a>
+ . Key takeaways:
+ <ul>
+ <li>
+ If you rely on software that uses a version of commons-configuration prior to 2.8.0, you are likely
+ still not vulnerable: only if this software loads configuration
+ files from untrusted sources, which is likely rare.
+ </li>
+ <li>
+ If your own software uses commons-configuration, double-check whether it loads
+ configuration files from untrusted sources. If so, an update to 2.8.0 could be a
+ quick workaround, but the recommended solution is to also properly validate and sanitize the
+ untrusted input.
+ </li>
+ </ul>
+ </p>
+ <p>
+ Apache Commons Configuration is a library to read configuration data from a variety of sources.
+ It supports variable interpolation with lookups using various mechanisms, such as system properties
+ or environment variables. Some of the available interpolators can trigger network
+ access or code execution. This is intended, but it also means an application that includes user
+ input in the configuration passed to Commons Configuration without properly sanitizing it would allow an
+ attacker to trigger those interpolators.
+ </p>
+ <p>
+ For that reason the Apache Commons Configuration team have decided to update the list of interpolators
+ that are enabled by default to be more
+ conservative, so that the impact of a failure to validate inputs is mitigated and will not
+ give an attacker access to these interpolators. However, it is still recommended that users treat
+ untrusted input with care.
+ </p>
+ <p>
+ We're not currently aware of any applications that load untrusted input as configuration
+ and thus would have been impacted by this problem prior to Apache Commons Configuration 2.8.0.
+ </p>
+ <p>
+ This issue is different from
+ <a href="https://logging.apache.org/log4j/2.x/security.html#log4j-2.15.0">Log4Shell (CVE-2021-44228)</a>
+ because in Log4Shell, string interpolation was possible from the log message body, which commonly
+ contains untrusted input. In the Apache Common Configuration issue, the processed configuration data
+ is much less likely to come from an untrusted source.
+ </p>
+ <p>
+ Credit: this issue was reported by
+ <a href="https://github.com/pwntester">@pwntester (Alvaro Muñoz)</a>
+ of the
+ <a href="https://securitylab.github.com">GitHub Security Lab team</a>
+ . Thank you!
+ </p>
+ <p>
+ References:
+ <ul>
+ <li>
+ <a href="https://lists.apache.org/thread/tdf5n7j80lfxdhs2764vn0xmpfodm87s">Announcement on dev@commons.apache.org</a>
+ </li>
+ <li>
+ <a href="https://www.openwall.com/lists/oss-security/2022/07/06/5">Announcement on oss-security</a>
+ </li>
+ <li>
+ <a href="https://www.cve.org/CVERecord?id=CVE-2022-33980">Advisory on cve.org</a>
+ </li>
+ <li>
+ <a href="https://securitylab.github.com/advisories/GHSL-2022-017_Apache_Commons_Configuration/">GHSL advisory</a>
+ </li>
+ </ul>
+ </p>
+ </subsection>
</section>
</body>
</document>
[commons-configuration] 01/04: Add a security page
Posted by gg...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
ggregory pushed a commit to branch release
in repository https://gitbox.apache.org/repos/asf/commons-configuration.git
commit 83b49231387d4c7ecdf7996bb471a769e7d73da2
Author: Gary Gregory <ga...@gmail.com>
AuthorDate: Thu Oct 13 08:58:19 2022 -0400
Add a security page
---
src/site/site.xml | 2 +-
src/site/xdoc/security.xml | 92 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 93 insertions(+), 1 deletion(-)
diff --git a/src/site/site.xml b/src/site/site.xml
index 20c46445..cef5a08c 100644
--- a/src/site/site.xml
+++ b/src/site/site.xml
@@ -29,6 +29,7 @@
<menu name="Configuration">
<item name="Overview" href="/index.html"/>
<item name="Download" href="https://commons.apache.org/configuration/download_configuration.cgi"/>
+ <item name="Security" href="security.html"/>
<item name="Issue Tracking" href="issue-tracking.html"/>
</menu>
@@ -48,7 +49,6 @@
<item name="Runtime Dependencies" href="/dependencies_1_10.html"/>
</item>
</menu>
-
</body>
</project>
diff --git a/src/site/xdoc/security.xml b/src/site/xdoc/security.xml
new file mode 100644
index 00000000..7569bc97
--- /dev/null
+++ b/src/site/xdoc/security.xml
@@ -0,0 +1,92 @@
+<?xml version="1.0"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements. See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+<document>
+ <properties>
+ <title>Apache Commons Configuration Security Reports</title>
+ <author email="dev@commons.apache.org">Commons Team</author>
+ </properties>
+ <body>
+ <section name="General Information">
+ <p>
+ For information about reporting or asking questions about
+ security problems, please see the
+ <a href="https://commons.apache.org/security.html">security page</a>
+ of the Apache Commons project.
+ </p>
+ </section>
+
+ <section name="Apache Commons Configuration Security Vulnerabilities">
+ <p>This page lists all security vulnerabilities fixed in
+ released versions of Apache Commons Configuration.
+ </p>
+
+ <p>Please note that binary patches are never provided. If you
+ need to apply a source code patch, use the building
+ instructions for the Commons Configuration version that you are
+ using.
+ </p>
+
+ <p>
+ If you need help on building Commons Configuration or other help
+ on following the instructions to mitigate the known
+ vulnerabilities listed here, please send your questions to the
+ public
+ <a href="mail-lists.html">Compress Users mailing
+ list
+ </a>
+ .
+ </p>
+
+ <p>If you have encountered an unlisted security vulnerability
+ or other unexpected behavior that has security impact, or if
+ the descriptions here are incomplete, please report them
+ privately to the Apache Security Team. Thank you.
+ </p>
+
+ <subsection name="Fixed in Apache Commons Configuration 2.8.0">
+ <ul>
+ <p>
+ <a href="https://nvd.nist.gov/vuln/detail/CVE-2022-33980">CVE-2022-33980</a>
+ </p>
+ <p>
+ Apache Commons Configuration performs variable interpolation, allowing properties to be dynamically evaluated and
+ expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to
+ locate an instance of org.apache.commons.configuration2.interpol.Lookup that performs the
+ interpolation. Starting with version 2.4 and continuing through 2.7, the set of default Lookup
+ instances included interpolators that could result in arbitrary code execution or contact with
+ remote servers. These lookups are: - "script" - execute expressions using the JVM script
+ execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls,
+ including from remote servers Applications using the interpolation defaults in the affected
+ versions may be vulnerable to remote code execution or unintentional contact with remote servers
+ if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons
+ Configuration 2.8.0, which disables the problematic interpolators by default.
+ </p>
+ </ul>
+
+ </subsection>
+ </section>
+
+ <section name="Errors and Omissions">
+ <p>
+ Please report any errors or omissions to
+ <a href="mail-lists.html">the dev mailing list</a>
+ .
+ </p>
+ </section>
+ </body>
+</document>
[commons-configuration] 02/04: Simplify security page.
Posted by gg...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
ggregory pushed a commit to branch release
in repository https://gitbox.apache.org/repos/asf/commons-configuration.git
commit 7dcb0b64db1128aaddf4a6c73523b01eb8e73835
Author: Gary Gregory <ga...@gmail.com>
AuthorDate: Thu Oct 13 20:52:58 2022 -0400
Simplify security page.
Don't duplicate contents of CVE since the CVE can be edited after
publication.
---
src/site/xdoc/security.xml | 86 +++++++++++++---------------------------------
1 file changed, 24 insertions(+), 62 deletions(-)
diff --git a/src/site/xdoc/security.xml b/src/site/xdoc/security.xml
index 7569bc97..b7f3f10b 100644
--- a/src/site/xdoc/security.xml
+++ b/src/site/xdoc/security.xml
@@ -1,92 +1,54 @@
<?xml version="1.0"?>
-<!--
- Licensed to the Apache Software Foundation (ASF) under one or more
- contributor license agreements. See the NOTICE file distributed with
- this work for additional information regarding copyright ownership.
- The ASF licenses this file to You under the Apache License, Version 2.0
- (the "License"); you may not use this file except in compliance with
- the License. You may obtain a copy of the License at
-
- http://www.apache.org/licenses/LICENSE-2.0
-
- Unless required by applicable law or agreed to in writing, software
- distributed under the License is distributed on an "AS IS" BASIS,
- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- See the License for the specific language governing permissions and
- limitations under the License.
--->
+<!-- Licensed to the Apache Software Foundation (ASF) under one or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information regarding copyright ownership. The ASF licenses this file to You under
+ the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may
+ obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to
+ in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF
+ ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under
+ the License. -->
<document>
<properties>
<title>Apache Commons Configuration Security Reports</title>
<author email="dev@commons.apache.org">Commons Team</author>
</properties>
<body>
- <section name="General Information">
+ <section name="Security Vulnerabilities">
<p>
For information about reporting or asking questions about
- security problems, please see the
+ security, please see the
<a href="https://commons.apache.org/security.html">security page</a>
of the Apache Commons project.
</p>
- </section>
-
- <section name="Apache Commons Configuration Security Vulnerabilities">
- <p>This page lists all security vulnerabilities fixed in
- released versions of Apache Commons Configuration.
+ <p>
+ This page lists all security vulnerabilities fixed in released versions of this component.
</p>
- <p>Please note that binary patches are never provided. If you
- need to apply a source code patch, use the building
- instructions for the Commons Configuration version that you are
- using.
+ <p>
+ Please note that binary patches are never provided. If you need to apply a source code patch, use the
+ building instructions for the Commons Configuration version that you are using.
</p>
<p>
- If you need help on building Commons Configuration or other help
- on following the instructions to mitigate the known
- vulnerabilities listed here, please send your questions to the
- public
- <a href="mail-lists.html">Compress Users mailing
- list
- </a>
- .
+ If you need help on building Commons Configuration or other help on following the instructions to
+ mitigate the known vulnerabilities listed here, please send your questions to the public
+ <a href="mail-lists.html">user mailing list</a>.
</p>
- <p>If you have encountered an unlisted security vulnerability
- or other unexpected behavior that has security impact, or if
- the descriptions here are incomplete, please report them
- privately to the Apache Security Team. Thank you.
+ <p>
+ If you have encountered an unlisted security vulnerability or other unexpected behavior that has security
+ impact, or if the descriptions here are incomplete, please report them privately to the Apache Security
+ Team. Thank you.
</p>
<subsection name="Fixed in Apache Commons Configuration 2.8.0">
<ul>
- <p>
+ <li>
<a href="https://nvd.nist.gov/vuln/detail/CVE-2022-33980">CVE-2022-33980</a>
- </p>
- <p>
- Apache Commons Configuration performs variable interpolation, allowing properties to be dynamically evaluated and
- expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to
- locate an instance of org.apache.commons.configuration2.interpol.Lookup that performs the
- interpolation. Starting with version 2.4 and continuing through 2.7, the set of default Lookup
- instances included interpolators that could result in arbitrary code execution or contact with
- remote servers. These lookups are: - "script" - execute expressions using the JVM script
- execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls,
- including from remote servers Applications using the interpolation defaults in the affected
- versions may be vulnerable to remote code execution or unintentional contact with remote servers
- if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons
- Configuration 2.8.0, which disables the problematic interpolators by default.
- </p>
+ Variable interpolation can cause arbitrary code execution.
+ </li>
</ul>
</subsection>
</section>
-
- <section name="Errors and Omissions">
- <p>
- Please report any errors or omissions to
- <a href="mail-lists.html">the dev mailing list</a>
- .
- </p>
- </section>
</body>
</document>
[commons-configuration] 03/04: Simplify security page.
Posted by gg...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
ggregory pushed a commit to branch release
in repository https://gitbox.apache.org/repos/asf/commons-configuration.git
commit 6634e7842b7c58fc8d07bb795ba6338c03a05ca3
Author: Gary Gregory <ga...@gmail.com>
AuthorDate: Thu Oct 13 20:57:36 2022 -0400
Simplify security page.
---
src/site/xdoc/security.xml | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/src/site/xdoc/security.xml b/src/site/xdoc/security.xml
index b7f3f10b..bcaef141 100644
--- a/src/site/xdoc/security.xml
+++ b/src/site/xdoc/security.xml
@@ -25,11 +25,11 @@
<p>
Please note that binary patches are never provided. If you need to apply a source code patch, use the
- building instructions for the Commons Configuration version that you are using.
+ building instructions for the component version that you are using.
</p>
<p>
- If you need help on building Commons Configuration or other help on following the instructions to
+ If you need help on building this component or other help on following the instructions to
mitigate the known vulnerabilities listed here, please send your questions to the public
<a href="mail-lists.html">user mailing list</a>.
</p>