Upstream information

CVE-2022-33980 at MITRE

Description

Apache Commons Configuration performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.configuration2.interpol.Lookup that performs the interpolation. Starting with version 2.4 and continuing through 2.7, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - "script" - execute expressions using the JVM script execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Configuration 2.8.0, which disables the problematic interpolators by default.

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having important severity.

CVSS v2 Scores
  National Vulnerability Database
Base Score 7.5
Vector AV:N/AC:L/Au:N/C:P/I:P/A:P
Access Vector Network
Access Complexity Low
Authentication None
Confidentiality Impact Partial
Integrity Impact Partial
Availability Impact Partial
CVSS v3 Scores
  National Vulnerability Database SUSE
Base Score 9.8 8.1
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:L
Access Vector Network Network
Access Complexity Low High
Privileges Required None None
User Interaction None None
Scope Unchanged Changed
Confidentiality Impact High High
Integrity Impact High Low
Availability Impact High Low
CVSSv3 Version 3.1 3.1
SUSE Bugzilla entry: 1201279 [RESOLVED / INVALID]

No SUSE Security Announcements cross referenced.


Status of this issue by product and package

Please note that this evaluation state might be work in progress, incomplete or outdated. Also information for service packs in the LTSS phase is only included for issues meeting the LTSS criteria. If in doubt, feel free to contact us for clarification.

Product(s) Source package State
SUSE Enterprise Storage 7 apache-commons-configuration Not affected
SUSE Linux Enterprise Desktop 15 SP3 apache-commons-configuration Not affected
SUSE Linux Enterprise Desktop 15 SP4 apache-commons-configuration Not affected
SUSE Linux Enterprise High Performance Computing 15 SP2 ESPOS apache-commons-configuration Not affected
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS apache-commons-configuration Not affected
SUSE Linux Enterprise High Performance Computing 15 SP3 apache-commons-configuration Not affected
SUSE Linux Enterprise High Performance Computing 15 SP4 apache-commons-configuration Not affected
SUSE Linux Enterprise Module for Development Tools 15 SP3 apache-commons-configuration Not affected
SUSE Linux Enterprise Module for Development Tools 15 SP4 apache-commons-configuration Not affected
SUSE Linux Enterprise Server 15 SP2 LTSS apache-commons-configuration Not affected
SUSE Linux Enterprise Server 15 SP3 apache-commons-configuration Not affected
SUSE Linux Enterprise Server 15 SP4 apache-commons-configuration Not affected
SUSE Linux Enterprise Server Business Critical Linux 15 SP2 apache-commons-configuration Not affected
SUSE Linux Enterprise Server for SAP Applications 15 SP2 apache-commons-configuration Not affected
SUSE Linux Enterprise Server for SAP Applications 15 SP3 apache-commons-configuration Not affected
SUSE Linux Enterprise Server for SAP Applications 15 SP4 apache-commons-configuration Not affected
SUSE Linux Enterprise Storage 7.1 apache-commons-configuration Not affected
SUSE Manager Proxy 4.1 apache-commons-configuration Not affected
SUSE Manager Proxy 4.2 apache-commons-configuration Not affected
SUSE Manager Proxy 4.3 apache-commons-configuration Not affected
SUSE Manager Retail Branch Server 4.1 apache-commons-configuration Not affected
SUSE Manager Retail Branch Server 4.2 apache-commons-configuration Not affected
SUSE Manager Retail Branch Server 4.3 apache-commons-configuration Not affected
SUSE Manager Server 4.1 apache-commons-configuration Not affected
SUSE Manager Server 4.2 apache-commons-configuration Not affected
SUSE Manager Server 4.3 apache-commons-configuration Not affected