Log in Start free

Vulnerability · Published Mar 21, 2024 · Assigned by apache

CVE-2024-29133Apache Commons Configuration: StackOverflowError calling ListDelimiterHandler.flatten(Object, int) with a cyclical object tree

Medium 5.4

In plain English

A medium-severity out-of-bounds write in Apache Commons Configuration from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 78% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)1.7%top 22.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Out-of-bounds Write vulnerability in Apache Commons Configuration.This issue affects Apache Commons Configuration: from 2.0 before 2.10.1. Users are recommended to upgrade to version 2.10.1, which fixes the issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12commons-configuration2no fix listedDEBIAN-CVE-2024-29133
Debian:13commons-configuration22.10.1-1DEBIAN-CVE-2024-29133
Debian:14commons-configuration22.10.1-1DEBIAN-CVE-2024-29133
Mavenorg.apache.commons:commons-configuration22.10.1GHSA-9w38-p64v-xpmv
Ubuntu:22.04:LTScommons-configuration2no fix listedUBUNTU-CVE-2024-29133
Ubuntu:24.04:LTScommons-configuration2no fix listedUBUNTU-CVE-2024-29133

Affected products (as reported)

VendorProductVersions
Apache Software Foundation Apache Commons Configuration 2.0 – before 2.10.1

Weakness: CWE-787 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

References