Security Update for libcommons-collections3-java
Summary
DSA-3403-1: libcommons-collections3-java - security update. Affects libcommons-collections3-java versions < 3.2.1-5+deb7u1. Fixed in 3.2.1-5+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libcommons-collections3-java is a Java library that provides a set of reusable collection classes, algorithms, and utilities. It is commonly used in Java applications for managing collections of objects. However, a vulnerability has been discovered in the library that allows for the deserialization of objects from untrusted sources without proper sanitization, potentially leading to remote code execution or other security issues.
Vulnerability Detail
The vulnerability in libcommons-collections3-java arises from the deserialization of certain classes without proper validation of the input data. This can be exploited by an attacker to execute arbitrary code or perform other malicious actions on the affected system. The classes considered unsafe and affected by this vulnerability are: CloneTransformer, ForClosure, InstantiateFactory, InstantiateTransformer, InvokerTransformer, PrototypeCloneFactory, PrototypeSerializationFactory, and WhileClosure.
How To Fix
Minimum fixed version
3.2.1-5+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libcommons-collections3-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading the package is not immediately feasible, a workaround is to disable the deserialization of the affected classes by setting the system property org.apache.commons.collections.enableUnsafeSerialization to false. However, this workaround may impact the functionality of applications that rely on the deserialization of these classes.
Conclusion
It is crucial to promptly upgrade the libcommons-collections3-java package to the recommended versions to mitigate the security risks associated with this vulnerability. Failure to do so may expose the system to potential remote code execution or other malicious activities. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for libcommons-collections3-java →
FAQ
libcommons-collections3-java is a Java library that provides reusable collection classes, algorithms, and utilities for managing collections of objects in Java applications.
The vulnerability allows for the deserialization of objects from untrusted sources without proper sanitization, which can lead to remote code execution or other security issues.
The classes affected by this vulnerability are: CloneTransformer, ForClosure, InstantiateFactory, InstantiateTransformer, InvokerTransformer, PrototypeCloneFactory, PrototypeSerializationFactory, and WhileClosure.
To fix this vulnerability, upgrade the libcommons-collections3-java package to the recommended versions mentioned in the 'how_to_fix' section.
Yes, a workaround is to disable the deserialization of the affected classes by setting the system property org.apache.commons.collections.enableUnsafeSerialization to false. However, this may impact the functionality of applications relying on the deserialization of these classes.
Related vulnerabilities
Recent vulnerabilities recorded for libcommons-collections3-java.
