Bug#1014960: commons-configuration2: CVE-2022-33980

[Moritz Mühlenhoff]

Source: commons-configuration2
X-Debbugs-CC: team at security.debian.org
Severity: important
Tags: security

Hi,

The following vulnerability was published for commons-configuration2.

CVE-2022-33980[0]:
| Apache Commons Configuration performs variable interpolation, allowing
| properties to be dynamically evaluated and expanded. The standard
| format for interpolation is "${prefix:name}", where "prefix" is used
| to locate an instance of
| org.apache.commons.configuration2.interpol.Lookup that performs the
| interpolation. Starting with version 2.4 and continuing through 2.7,
| the set of default Lookup instances included interpolators that could
| result in arbitrary code execution or contact with remote servers.
| These lookups are: - "script" - execute expressions using the JVM
| script execution engine (javax.script) - "dns" - resolve dns records -
| "url" - load values from urls, including from remote servers
| Applications using the interpolation defaults in the affected versions
| may be vulnerable to remote code execution or unintentional contact
| with remote servers if untrusted configuration values are used. Users
| are recommended to upgrade to Apache Commons Configuration 2.8.0,
| which disables the problematic interpolators by default.

https://www.openwall.com/lists/oss-security/2022/07/06/5

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2022-33980
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-33980

Please adjust the affected versions in the BTS as needed.