Apache Commons Configuration: StackOverflowError calling ListDelimiterHandler.flatten(Object, int) with a cyclical object tree

🗓️ 21 Mar 2024 09:31:14Reported by GitHub Advisory DatabaseType

github

github🔗 github.com👁 23 Views

Apache Commons Configuration Out-Of-Bounds Write Vulnerability Fi

Reporter	Title	Published	Views	Family All 97
IBM Security Bulletins	Security Bulletin: IBM License Key Server Administration Agent is vulnerable to a remote code attack in Apache Commons (CVE-2024-29131, CVE-2024-29133)	30 Jul 202416:54	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Asset Data Dictionary uses multiple third party dependencies which is vulnerable to CVEs.	6 Feb 202505:30	–	ibm
IBM Security Bulletins	Security Bulletin: DataStage on Cloud Pak for Data is vulnerable to out of bounds writes due to hbase-client	10 Mar 202515:31	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM® Db2® affect IBM® Db2® Big SQL.	25 Jan 202611:57	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Analytics Content Hub is affected by security vulnerabilities	27 Nov 202414:26	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to a code execution vulnerability in Apache Commons Configuration ( CVE-2024-29131)	21 Jun 202414:56	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities reported in YAJSW service shipped in IBM WebSphere eXtreme Scale Liberty Deployment	2 May 202402:53	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image	17 Apr 202406:43	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Connect:Direct for Microsoft Windows is vulnerable to issues due to Apache Commons Configuration and Fasterxml jackson-databind	19 Jun 202410:32	–	ibm
IBM Security Bulletins	Security Bulletin: Apache Commons Configuration Vulnerability Affects IBM Jazz Reporting Service	22 Oct 202410:19	–	ibm

Vulners

Node

org.apache.commons commons-configuration2Range2.0–2.10.1maven

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-29133
lists	www.lists.apache.org/thread/ccb9w15bscznh6tnp3wsvrrj9crbszh2
github	www.github.com/apache/commons-configuration/commit/43f4dab021e9acb8db390db2ae80aa0cee4f9ee4
issues	www.issues.apache.org/jira/browse/CONFIGURATION-841
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/SNKDKEEKZNL5FGCTZKJ6CFXFVWFL5FJ7
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/YD4AFTIIQW662LUAQRMWS6BBKYSZG3YS
openwall	www.openwall.com/lists/oss-security/2024/03/20/3
github	www.github.com/advisories/GHSA-9w38-p64v-xpmv

13 Feb 2025 19:04Current

5.6Medium risk

Vulners AI Score5.6

CVSS 3.15.4

EPSS0.00997

SSVC

apache commons configuration out-of-bounds write vulnerability fix upgrade stackoverflowerror listdelimiterhandler object tree