Skip to content

Commit aefd84a

Browse files
ppkarwaszgarydgregory
ppkarwasz
and
garydgregory
authored
Add VEX entry for CVE-2025-48924 (#587)
* feat: Add VEX entry for CVE-2025-48924 This change introduces a VEX entry clarifying that Apache Commons Configuration **is** impacted by CVE-2025-48924 under some conditions. Although parsing configuration files from **untrusted sources** is generally discouraged, the [Commons Configuration Security Model](https://commons.apache.org/proper/commons-configuration/security.html#Security_Model) was **relaxed** in February 2025 (see #540). These changes ensure that Commons Configuration is not vulnerable to remote code execution (RCE) or denial of service (DoS), even when processing untrusted input—provided safe usage patterns are followed. This VEX entry documents those requirements and mitigation steps, helping downstream consumers assess the true impact of the vulnerability in their environments. * fix: Apply suggestions from code review Co-authored-by: Gary Gregory <garydgregory@users.noreply.github.com> --------- Co-authored-by: Gary Gregory <garydgregory@users.noreply.github.com>
1 parent c89d8c9 commit aefd84a

2 files changed

Lines changed: 196 additions & 0 deletions

File tree

‎src/conf/security/README.md‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
<!--
2+
~ Licensed to the Apache Software Foundation (ASF) under one or more
3+
~ contributor license agreements. See the NOTICE file distributed with
4+
~ this work for additional information regarding copyright ownership.
5+
~ The ASF licenses this file to you under the Apache License, Version 2.0
6+
~ (the "License"); you may not use this file except in compliance with
7+
~ the License. You may obtain a copy of the License at
8+
~
9+
~ http://www.apache.org/licenses/LICENSE-2.0
10+
~
11+
~ Unless required by applicable law or agreed to in writing, software
12+
~ distributed under the License is distributed on an "AS IS" BASIS,
13+
~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
~ See the License for the specific language governing permissions and
15+
~ limitations under the License.
16+
-->
17+
18+
# CycloneDX Documents for Apache Commons Configuration
19+
20+
The Apache Commons Configuration project publishes multiple [CycloneDX](https://cyclonedx.org/) documents to help consumers assess the security of their applications using this library:
21+
22+
## SBOM (Software Bill of Materials)
23+
24+
Beginning with version `2.9.0`, Apache Commons Configuration publishes SBOMs in both **XML** and **JSON** formats to Maven Central. These documents describe all components and dependencies of the library, following standard Maven coordinates:
25+
26+
* **Group ID:** `org.apache.commons`
27+
* **Artifact ID:** `commons-configuration2`
28+
* **Classifier:** `cyclonedx`
29+
* **Type:** `xml` or `json`
30+
31+
Each SBOM lists the library’s required and optional dependencies, helping consumers analyze the software supply chain and manage dependency risk.
32+
33+
> [!NOTE]
34+
> The versions listed in the SBOM reflect the dependencies used during the build and test process for that specific release of Commons Configuration.
35+
> Your own project may use different versions depending on your dependency management configuration.
36+
37+
## VEX (Vulnerability Exploitability eXchange)
38+
39+
An experimental [VEX](https://cyclonedx.org/capabilities/vex/) document is also published:
40+
41+
👉 [`https://raw.githubusercontent.com/apache/commons-configuration/refs/heads/master/src/conf/security/VEX.cyclonedx.xml`](VEX.cyclonedx.xml)
42+
43+
This document provides information about the **exploitability of known vulnerabilities** in the **dependencies** of Apache Commons Configuration.
44+
45+
### When is a dependency vulnerability exploitable?
46+
47+
Because Apache Commons libraries (including Configuration) do **not** bundle their dependencies, a vulnerability in a dependency is only exploitable if **both** of the following conditions are true:
48+
49+
1. The vulnerable dependency is included in the consuming project.
50+
2. Apache Commons Configuration is explicitly listed as affected by the vulnerability.
51+
52+
### Notes and Limitations
53+
54+
* This VEX document is **experimental** and provided **as-is**.
55+
The semantics of this document may change in the future.
56+
* The **absence** of a vulnerability entry does **not** indicate that Configuration is unaffected.
57+
* If a version of Configuration is not listed under the `affects` section of a vulnerability, that version may still be affected or not.
58+
* Only the **latest major version** of Configuration is currently assessed for vulnerabilities.
59+
* The `analysis` field in the VEX file uses **Markdown** formatting.
60+
61+
For more information about CycloneDX, SBOMs, or VEX, visit [cyclonedx.org](https://cyclonedx.org/).

‎src/conf/security/VEX.cyclonedx.xml‎

Lines changed: 135 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,135 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!--
3+
~ Licensed to the Apache Software Foundation (ASF) under one or more
4+
~ contributor license agreements. See the NOTICE file distributed with
5+
~ this work for additional information regarding copyright ownership.
6+
~ The ASF licenses this file to you under the Apache License, Version 2.0
7+
~ (the "License"); you may not use this file except in compliance with
8+
~ the License. You may obtain a copy of the License at
9+
~
10+
~ http://www.apache.org/licenses/LICENSE-2.0
11+
~
12+
~ Unless required by applicable law or agreed to in writing, software
13+
~ distributed under the License is distributed on an "AS IS" BASIS,
14+
~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
~ See the License for the specific language governing permissions and
16+
~ limitations under the License.
17+
-->
18+
<!--
19+
To update this document:
20+
1. Increment the `version` attribute in the <bom> element.
21+
2. Update the `timestamp` in the <metadata> section.
22+
-->
23+
<bom xmlns="http://cyclonedx.org/schema/bom/1.6"
24+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
25+
xsi:schemaLocation="http://cyclonedx.org/schema/bom/1.6 https://cyclonedx.org/schema/bom-1.6.xsd"
26+
serialNumber="urn:uuid:5181c7a1-21fd-48b1-8d7b-285c2204c809"
27+
version="1">
28+
<metadata>
29+
<timestamp>2025-08-04T11:45:36Z</timestamp>
30+
<component type="library" bom-ref="main_component">
31+
<group>org.apache.commons</group>
32+
<name>commons-configuration2</name>
33+
<cpe>cpe:2.3:a:apache:commons_configuration:*:*:*:*:*:*:*:*</cpe>
34+
<purl>pkg:maven/org.apache.commons/commons-configuration2?type=jar</purl>
35+
</component>
36+
<manufacturer>
37+
<name>The Apache Software Foundation</name>
38+
<url>https://commons.apache.org</url>
39+
<contact>
40+
<name>Apache Commons PMC</name>
41+
<email>dev@commons.apache.org</email>
42+
</contact>
43+
<contact>
44+
<name>Apache Commons Security Team</name>
45+
<email>security@commons.apache.org</email>
46+
</contact>
47+
</manufacturer>
48+
</metadata>
49+
<vulnerabilities>
50+
<vulnerability>
51+
<id>CVE-2025-48924</id>
52+
<references>
53+
<reference>
54+
<id>GHSA-j288-q9x7-2f5v</id>
55+
<source>
56+
<url>https://github.com/advisories/GHSA-j288-q9x7-2f5v</url>
57+
</source>
58+
</reference>
59+
</references>
60+
<analysis>
61+
<state>exploitable</state>
62+
<responses>
63+
<response>update</response>
64+
</responses>
65+
<detail>
66+
CVE-2025-48924 **affects** Apache Commons Configuration versions 2.4 and later, but only when **all** of the following conditions are met:
67+
68+
* The application includes a **vulnerable version** of Commons Lang on the classpath.
69+
* The library is used to parse configuration files from **untrusted sources**.
70+
71+
When these conditions are present, an attacker can trigger an **infinite loop** by submitting a configuration containing a `${const:...}` expression.
72+
73+
### Root Cause
74+
75+
This issue stems from the use of a default `ConfigurationInterpolator`, which delegates string resolution to Commons Text’s `InterpolatorStringLookup`.
76+
This lookup is exploitable under certain conditions, as detailed in the [Commons Text VEX document](https://raw.githubusercontent.com/apache/commons-text/refs/heads/master/src/conf/security/VEX.cyclonedx.xml).
77+
78+
### Recommended Mitigations
79+
80+
Projects that process untrusted configuration input should:
81+
82+
* **Upgrade Commons Lang** to version 3.18.0 or later.
83+
* **Restrict `Lookup` classes** used by the `ConfigurationInterpolator` to safe implementations by explicitly configuring them via `Configuration.installInterpolator`.
84+
85+
### References
86+
87+
* [Commons Text VEX document](https://raw.githubusercontent.com/apache/commons-text/refs/heads/master/src/conf/security/VEX.cyclonedx.xml)
88+
</detail>
89+
<firstIssued>2025-08-04T11:45:36Z</firstIssued>
90+
<lastUpdated>2025-08-04T11:45:36Z</lastUpdated>
91+
</analysis>
92+
<affects>
93+
<target>
94+
<ref>main_component</ref>
95+
<versions>
96+
<version>
97+
<range><![CDATA[vers:maven/>=2.4|<3]]></range>
98+
<status>affected</status>
99+
</version>
100+
</versions>
101+
</target>
102+
</affects>
103+
</vulnerability>
104+
</vulnerabilities>
105+
<annotations>
106+
<annotation>
107+
<annotator>
108+
<individual>
109+
<name>Apache Commons PMC</name>
110+
<email>dev@commons.apache.org</email>
111+
</individual>
112+
</annotator>
113+
<timestamp>2025-08-04T11:45:36Z</timestamp>
114+
<text>
115+
This document provides information about the **exploitability of known vulnerabilities** in the **dependencies** of Apache Commons Text.
116+
117+
# When is a dependency vulnerability exploitable?
118+
119+
Because Apache Commons libraries do **not** bundle their dependencies, a vulnerability in a dependency is only exploitable if **both** of the following conditions are true:
120+
121+
1. The vulnerable dependency is included in the consuming project.
122+
2. Apache Commons Text is explicitly listed as affected by the vulnerability.
123+
124+
# Notes and Limitations
125+
126+
* This VEX document is **experimental** and provided **as-is**.
127+
The semantics of this document may change in the future.
128+
* The **absence** of a vulnerability entry does **not** indicate that this component is unaffected.
129+
* If a version of Text is not listed under the `affects` section of a vulnerability, that version may still be affected or not.
130+
* Only the **latest major version** of Text is currently assessed for vulnerabilities.
131+
* The `analysis` field in the VEX file uses **Markdown** formatting.
132+
</text>
133+
</annotation>
134+
</annotations>
135+
</bom>

0 commit comments

Comments
 (0)