Changelog
commons-configuration2 (2.8.0-1~deb11u1) bullseye-security; urgency=high
* Team upload.
* Backport version 2.8.0 from Bullseye.
* Fix CVE-2022-33980:
Apache Commons Configuration performs variable interpolation, allowing
properties to be dynamically evaluated and expanded. Starting with version
2.4 and continuing through 2.7, the set of default Lookup instances
included interpolators that could result in arbitrary code execution or
contact with remote servers. These lookups are: - "script" - execute
expressions using the JVM script execution engine (javax.script) - "dns" -
resolve dns records - "url" - load values from urls, including from remote
servers Applications using the interpolation defaults in the affected
versions may be vulnerable to remote code execution or unintentional
contact with remote servers if untrusted configuration values are used.
(Closes: #1014960)
-- Markus Koschany <email address hidden> Mon, 28 Nov 2022 10:52:07 +0100
