csaf_redhat - rhsa-2025:9166

rhsa-2025:9166

Vulnerability from csaf_redhat

Published

2025-06-17 09:07

Modified

2025-08-06 21:01

Summary

Red Hat Security Advisory: apache-commons-beanutils security update

Notes

Topic

An update for apache-commons-beanutils is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details

The Apache Commons BeanUtils library provides utility methods for accessing and modifying properties of arbitrary JavaBeans. Security Fix(es): * commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default (CVE-2025-48734) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for apache-commons-beanutils is now available for Red Hat Enterprise Linux 10.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The Apache Commons BeanUtils library provides utility methods for accessing and modifying properties of arbitrary JavaBeans.\n\nSecurity Fix(es):\n\n* commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum\u0027s declaredClass property by default (CVE-2025-48734)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2025:9166",
        "url": "https://access.redhat.com/errata/RHSA-2025:9166"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2368956",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2368956"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9166.json"
      }
    ],
    "title": "Red Hat Security Advisory: apache-commons-beanutils security update",
    "tracking": {
      "current_release_date": "2025-08-06T21:01:15+00:00",
      "generator": {
        "date": "2025-08-06T21:01:15+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.6.6"
        }
      },
      "id": "RHSA-2025:9166",
      "initial_release_date": "2025-06-17T09:07:56+00:00",
      "revision_history": [
        {
          "date": "2025-06-17T09:07:56+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2025-06-17T09:07:56+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2025-08-06T21:01:15+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
                "product": {
                  "name": "Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
                  "product_id": "CRB-10.0.Z",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:10.0"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "apache-commons-beanutils-0:1.9.4-21.el10_0.src",
                "product": {
                  "name": "apache-commons-beanutils-0:1.9.4-21.el10_0.src",
                  "product_id": "apache-commons-beanutils-0:1.9.4-21.el10_0.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/apache-commons-beanutils@1.9.4-21.el10_0?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "apache-commons-beanutils-0:1.9.4-21.el10_0.noarch",
                "product": {
                  "name": "apache-commons-beanutils-0:1.9.4-21.el10_0.noarch",
                  "product_id": "apache-commons-beanutils-0:1.9.4-21.el10_0.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/apache-commons-beanutils@1.9.4-21.el10_0?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "apache-commons-beanutils-javadoc-0:1.9.4-21.el10_0.noarch",
                "product": {
                  "name": "apache-commons-beanutils-javadoc-0:1.9.4-21.el10_0.noarch",
                  "product_id": "apache-commons-beanutils-javadoc-0:1.9.4-21.el10_0.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/apache-commons-beanutils-javadoc@1.9.4-21.el10_0?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache-commons-beanutils-0:1.9.4-21.el10_0.noarch as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
          "product_id": "CRB-10.0.Z:apache-commons-beanutils-0:1.9.4-21.el10_0.noarch"
        },
        "product_reference": "apache-commons-beanutils-0:1.9.4-21.el10_0.noarch",
        "relates_to_product_reference": "CRB-10.0.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache-commons-beanutils-0:1.9.4-21.el10_0.src as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
          "product_id": "CRB-10.0.Z:apache-commons-beanutils-0:1.9.4-21.el10_0.src"
        },
        "product_reference": "apache-commons-beanutils-0:1.9.4-21.el10_0.src",
        "relates_to_product_reference": "CRB-10.0.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache-commons-beanutils-javadoc-0:1.9.4-21.el10_0.noarch as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
          "product_id": "CRB-10.0.Z:apache-commons-beanutils-javadoc-0:1.9.4-21.el10_0.noarch"
        },
        "product_reference": "apache-commons-beanutils-javadoc-0:1.9.4-21.el10_0.noarch",
        "relates_to_product_reference": "CRB-10.0.Z"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-48734",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "discovery_date": "2025-05-28T14:00:56.619771+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2368956"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Commons BeanUtils. This vulnerability allows remote attackers to execute arbitrary code via uncontrolled access to the declaredClass property on Java enum objects, which can expose the class loader when property paths are passed from external sources to methods like getProperty() or getNestedProperty().",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum\u0027s declaredClass property by default",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as important severity because a flaw exists in Apache Commons BeanUtils, where PropertyUtilsBean and BeanUtilsBean allow uncontrolled access to the declaredClass property of Java enum objects. Applications that pass untrusted property paths directly to getProperty() or getNestedProperty() methods are at risk, as attackers can exploit this behavior to retrieve the ClassLoader instance and execute arbitrary code in the context of the affected application. This issue leads to compromise of confidentiality, integrity, and availability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "CRB-10.0.Z:apache-commons-beanutils-0:1.9.4-21.el10_0.noarch",
          "CRB-10.0.Z:apache-commons-beanutils-0:1.9.4-21.el10_0.src",
          "CRB-10.0.Z:apache-commons-beanutils-javadoc-0:1.9.4-21.el10_0.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-48734"
        },
        {
          "category": "external",
          "summary": "RHBZ#2368956",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2368956"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-48734",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-48734"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-48734",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48734"
        },
        {
          "category": "external",
          "summary": "https://github.com/advisories/GHSA-wxr5-93ph-8wr9",
          "url": "https://github.com/advisories/GHSA-wxr5-93ph-8wr9"
        },
        {
          "category": "external",
          "summary": "https://github.com/apache/commons-beanutils/commit/28ad955a1613ed5885870cc7da52093c1ce739dc",
          "url": "https://github.com/apache/commons-beanutils/commit/28ad955a1613ed5885870cc7da52093c1ce739dc"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/s0hb3jkfj5f3ryx6c57zqtfohb0of1g9",
          "url": "https://lists.apache.org/thread/s0hb3jkfj5f3ryx6c57zqtfohb0of1g9"
        },
        {
          "category": "external",
          "summary": "https://www.openwall.com/lists/oss-security/2025/05/28/6",
          "url": "https://www.openwall.com/lists/oss-security/2025/05/28/6"
        }
      ],
      "release_date": "2025-05-28T13:32:08.300000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-06-17T09:07:56+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "CRB-10.0.Z:apache-commons-beanutils-0:1.9.4-21.el10_0.noarch",
            "CRB-10.0.Z:apache-commons-beanutils-0:1.9.4-21.el10_0.src",
            "CRB-10.0.Z:apache-commons-beanutils-javadoc-0:1.9.4-21.el10_0.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:9166"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CRB-10.0.Z:apache-commons-beanutils-0:1.9.4-21.el10_0.noarch",
            "CRB-10.0.Z:apache-commons-beanutils-0:1.9.4-21.el10_0.src",
            "CRB-10.0.Z:apache-commons-beanutils-javadoc-0:1.9.4-21.el10_0.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum\u0027s declaredClass property by default"
    }
  ]
}

CVE-2025-48734 (GCVE-0-2025-48734)

Vulnerability from cvelistv5

Published

2025-05-28 13:32

Modified

2025-05-29 03:55

Severity ?

CWE

CWE-284 - Improper Access Control

Summary

Improper Access Control vulnerability in Apache Commons. A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this protection was not enabled by default. PropertyUtilsBean (and consequently BeanUtilsBean) now disallows declared class level property access by default. Releases 1.11.0 and 2.0.0-M2 address a potential security issue when accessing enum properties in an uncontrolled way. If an application using Commons BeanUtils passes property paths from an external source directly to the getProperty() method of PropertyUtilsBean, an attacker can access the enum’s class loader via the “declaredClass” property available on all Java “enum” objects. Accessing the enum’s “declaredClass” allows remote attackers to access the ClassLoader and execute arbitrary code. The same issue exists with PropertyUtilsBean.getNestedProperty(). Starting in versions 1.11.0 and 2.0.0-M2 a special BeanIntrospector suppresses the “declaredClass” property. Note that this new BeanIntrospector is enabled by default, but you can disable it to regain the old behavior; see section 2.5 of the user's guide and the unit tests. This issue affects Apache Commons BeanUtils 1.x before 1.11.0, and 2.x before 2.0.0-M2.Users of the artifact commons-beanutils:commons-beanutils 1.x are recommended to upgrade to version 1.11.0, which fixes the issue. Users of the artifact org.apache.commons:commons-beanutils2 2.x are recommended to upgrade to version 2.0.0-M2, which fixes the issue.

References

►

URL

Tags

https://lists.apache.org/thread/s0hb3jkfj5f3ryx6c57zqtfohb0of1g9

vendor-advisory

Impacted products

Vendor

Product

Version

►

Apache Software Foundation

Apache Commons BeanUtils 1.x

Version: 1.0

Apache Software Foundation

Apache Commons BeanUtils 2.x

Version: 2.0.0-M1

Show details on NVD website