Log in Start free

Vulnerability · Published Mar 21, 2024 · Assigned by apache

CVE-2024-29131Apache Commons Configuration: StackOverflowError adding property in AbstractListDelimiterHandler.flattenIterator()

High 7.3

In plain English

A high-severity out-of-bounds write in Apache Commons Configuration from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 81% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.3High
Exploit odds (30 days)2.1%top 18.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Out-of-bounds Write vulnerability in Apache Commons Configuration.This issue affects Apache Commons Configuration: from 2.0 before 2.10.1. Users are recommended to upgrade to version 2.10.1, which fixes the issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12commons-configuration2no fix listedDEBIAN-CVE-2024-29131
Debian:13commons-configuration22.10.1-1DEBIAN-CVE-2024-29131
Debian:14commons-configuration22.10.1-1DEBIAN-CVE-2024-29131
Mavenorg.apache.commons:commons-configuration22.10.1GHSA-xjp4-hw94-mvp5
Ubuntu:22.04:LTScommons-configuration2no fix listedUBUNTU-CVE-2024-29131
Ubuntu:24.04:LTScommons-configuration2no fix listedUBUNTU-CVE-2024-29131

Affected products (as reported)

VendorProductVersions
Apache Software Foundation Apache Commons Configuration 2.0 – before 2.10.1

Weakness: CWE-787 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

References