Security Bulletin: IBM Cognos Command Center has addressed vulnerabilities IBM® Semeru Java™ Version 11 and Apache Commons

Summary There are vulnerabilities in IBM® Semeru Java™ Version 11, Apache Commons Compress and Apache Commons Configuration used by IBM Cognos Command Center. IBM Cognos Command Center 10.2.5 IF2 has addressed the applicable CVEs by upgrading to non-vulnerable versions of these libraries. Please...

Apache Commons Compress Loop Exit Condition

The vulnerability of the Apache Commons Compress library is related to the execution of a loop with an unreachable exit condition. Exploiting this vulnerability could allow an attacker to compromise the integrity, accessibility, and confidentiality of the protected information...

Security Bulletin: IBM Sterling B2B Integrator vulnerable to security bypass due to Apache Commons BCEL (CVE-2022-42920)

Summary IBM Sterling B2B Integrator uses Apache Commons BCEL. This bulletin identifies the steps to take to address the vulnerability. Vulnerability Details CVEID:CVE-2022-42920 DESCRIPTION: Apache Commons BCEL could allow a remote attacker to bypass security restrictions, caused by an...

Security Bulletin: IBM DevOps Deploy / IBM Urbancode Deploy (UCD) is vulnerable to denial of service due to Apache Commons Compress ( CVE-2024-25710, CVE-2024-26308 )

Summary Apache Commons Compress is vulnerable to a denial of service, caused by an infinite loop flaw. Apache Commons Compress is vulnerable to a denial of service, caused by an out of memory error. Vulnerability Details CVEID:CVE-2024-25710 DESCRIPTION: Apache Commons Compress is vulnerable to a...

org.xwiki.commons:xwiki-commons-legacy-velocity (>=15.0-rc-1, <=15.8), org.xwiki.rendering:xwiki-rendering-test (>=15.0-rc-1, <=15.8) potentially affected by CVE-2024-31996 via org.xwiki.commons:xwiki-commons-velocity (>=15.0-rc-1, <=15.8)

org.xwiki.commons:xwiki-commons-velocity MAVEN version =15.0-rc-1, =15.0-rc-1, =15.0-rc-1, =15.8 Source cves: CVE-2024-31996 Source advisory: MEND:CVE-2024-31996...

org.xwiki.commons:xwiki-commons-legacy-velocity (>=10.7-rc-1, <=14.10.18), org.xwiki.rendering:xwiki-rendering-syntax-xwiki10 (>=3.2-milestone-3, <=7.4.6) +1 more potentially affected by CVE-2024-31996 via org.xwiki.commons:xwiki-commons-velocity (>=3.2-milestone-3, <=14.10.18)

org.xwiki.commons:xwiki-commons-velocity MAVEN version =3.2-milestone-3, =10.7-rc-1, =3.2-milestone-3, =4.3-milestone-2, =14.10.18 Source cves: CVE-2024-31996 Source advisory: MEND:CVE-2024-31996...

org.xwiki.commons:xwiki-commons-legacy-velocity (>=15.0-rc-1, <=15.5.3), org.xwiki.rendering:xwiki-rendering-test (>=15.0-rc-1, <=15.5.3) potentially affected by CVE-2024-31996 via org.xwiki.commons:xwiki-commons-velocity (>=15.0-rc-1, <=15.5.3)

org.xwiki.commons:xwiki-commons-velocity MAVEN version =15.0-rc-1, =15.0-rc-1, =15.0-rc-1, =15.5.3 Source cves: CVE-2024-31996 Source advisory: OSV:GHSA-HF43-47Q4-FHQ5...

XWiki Commons missing escaping of `{` in Velocity escapetool allows remote code execution

Impact The HTML escaping of escaping tool that is used in XWiki doesn't escape , which, when used in certain places, allows XWiki syntax injection and thereby remote code execution. To reproduce in an XWiki installation, open...

org.xwiki.commons:xwiki-commons-legacy-velocity (>=10.7-rc-1, <=14.10.18), org.xwiki.rendering:xwiki-rendering-syntax-xwiki10 (>=3.2-milestone-3, <=7.4.6) +1 more potentially affected by CVE-2024-31996 via org.xwiki.commons:xwiki-commons-velocity (>=3.2-milestone-3, <=14.10.18)

org.xwiki.commons:xwiki-commons-velocity MAVEN version =3.2-milestone-3, =10.7-rc-1, =3.2-milestone-3, =4.3-milestone-2, =14.10.18 Source cves: CVE-2024-31996 Source advisory: GHSA-HF43-47Q4-FHQ5...

org.xwiki.commons:xwiki-commons-legacy-velocity (>=10.7-rc-1, <=14.10.18), org.xwiki.rendering:xwiki-rendering-syntax-xwiki10 (>=3.2-milestone-3, <=7.4.6) +1 more potentially affected by CVE-2024-31996 via org.xwiki.commons:xwiki-commons-velocity (>=3.2-milestone-3, <=14.10.18)

org.xwiki.commons:xwiki-commons-velocity MAVEN version =3.2-milestone-3, =10.7-rc-1, =3.2-milestone-3, =4.3-milestone-2, =14.10.18 Source cves: CVE-2024-31996 Source advisory: OSV:GHSA-HF43-47Q4-FHQ5...

org.xwiki.commons:xwiki-commons-legacy-velocity (>=15.0-rc-1, <=15.5.3), org.xwiki.rendering:xwiki-rendering-test (>=15.0-rc-1, <=15.5.3) potentially affected by CVE-2024-31996 via org.xwiki.commons:xwiki-commons-velocity (>=15.0-rc-1, <=15.5.3)

org.xwiki.commons:xwiki-commons-velocity MAVEN version =15.0-rc-1, =15.0-rc-1, =15.0-rc-1, =15.5.3 Source cves: CVE-2024-31996 Source advisory: GHSA-HF43-47Q4-FHQ5...

org.xwiki.commons:xwiki-commons-legacy-velocity (>=15.6-rc-1, <=15.8), org.xwiki.rendering:xwiki-rendering-test (>=15.6-rc-1, <=15.8) potentially affected by CVE-2024-31996 via org.xwiki.commons:xwiki-commons-velocity (>=15.6-rc-1, <=15.8)

org.xwiki.commons:xwiki-commons-velocity MAVEN version =15.6-rc-1, =15.6-rc-1, =15.6-rc-1, =15.8 Source cves: CVE-2024-31996 Source advisory: OSV:GHSA-HF43-47Q4-FHQ5...

org.xwiki.commons:xwiki-commons-legacy-velocity (>=15.6-rc-1, <=15.8), org.xwiki.rendering:xwiki-rendering-test (>=15.6-rc-1, <=15.8) potentially affected by CVE-2024-31996 via org.xwiki.commons:xwiki-commons-velocity (>=15.6-rc-1, <=15.8)

org.xwiki.commons:xwiki-commons-velocity MAVEN version =15.6-rc-1, =15.6-rc-1, =15.6-rc-1, =15.8 Source cves: CVE-2024-31996 Source advisory: GHSA-HF43-47Q4-FHQ5...

Apache Commons Compress Resource Consumption

The vulnerability of the Apache Commons Compress library is related to an uncontrolled resource consumption during the decompression of a corrupted Pack200 file. Exploiting this vulnerability allows an attacker to compromise the accessibility of protected information...

commons-compress: Denial of service caused by an infinite loop for a corrupted DUMP file

A loop with an unreachable exit condition Infinite Loop vulnerability was found in Apache Common Compress. This issue can lead to a denial of service...

commons-compress: OutOfMemoryError unpacking broken Pack200 file

An allocation of resources without limits or throttling vulnerability was found in Apache Commons Compress. This issue can lead to an out-of-memory error...

Security Bulletin: IBM Tivoli Netcool Impact is vulnerable to a denial of service due to Apache Commons Compress (CVE-2024-25710, CVE-2024-26308)

Summary Apache Commons Compress is shipped with IBM Tivoli Netcool Impact as part of it's server communication infrastructure. Information about security vulnerabilities affecting Apache Commons Compress has been published in a security bulletin. Vulnerability Details CVEID:CVE-2024-25710...

Important: Red Hat Security Advisory: Red Hat build of Quarkus 3.2.11 release and security update

An update is now available for Red Hat build of Quarkus. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability. For more informatio...

Bitbucket Data Center is affected by CVE-2024-25710

h3. Issue Summary Bitbucket is affected by CVE-2024-25710|https://nvd.nist.gov/vuln/detail/CVE-2024-25710 The affected file /app/WEB-INF/lib/commons-compress-1.21.jar h3. Steps to Reproduce N/A h3. Expected Results N/A h3. Actual Results N/A h3. Workaround Currently, there is no known workaround...

Fedora: Security Advisory (FEDORA-2024-fa7b758114)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...