Security Exception in java.util.regex.Pattern$GroupHead.match
Summary
OSV-2023-962: Security exception in java.base/java.util.regex.Pattern$GroupHead.match. Affects apache-commons-io versions >= 72b1f88fb722def136ce87c9b2bfdd3c9126bb3d, < d3e5bd6de8bc96abbadccea8b934dc038a32e90c. Fixed in d3e5bd6de8bc96abbadccea8b934dc038a32e90c. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The apache-commons-io package is a popular open-source library that provides utility classes for working with files, streams, and other I/O operations in Java. It is widely used in various applications and frameworks. This vulnerability affects the package due to a security exception in the java.util.regex.Pattern$GroupHead.match method.
Vulnerability Detail
The vulnerability arises from a security exception in the java.util.regex.Pattern$GroupHead.match method. It can be triggered when processing certain regular expressions, leading to a crash. The vulnerability has a low severity rating. It was reported through the OSS-Fuzz project and the details can be found in the OSS-Fuzz report. The crash occurs in the following sequence of method calls: java.util.regex.Pattern$GroupHead.match -> java.util.regex.Pattern$Loop.match -> java.util.regex.Pattern$GroupTail.match.
How To Fix
Minimum fixed version
d3e5bd6de8bc96abbadccea8b934dc038a32e90c
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, the apache-commons-io package is vulnerable to a security exception in the java.util.regex.Pattern$GroupHead.match method. The vulnerability can cause crashes in applications processing certain regular expressions. It is recommended to update the package to a fixed version to mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for apache-commons-io →
FAQ
The impact of this vulnerability is a potential crash in applications that use the apache-commons-io package and process regular expressions triggering the vulnerable code. However, the severity of the crash is low.
There is no known exploit for this vulnerability at the moment.
No, this vulnerability cannot be exploited remotely. It requires processing of specific regular expressions within the application.
No, only versions introduced between c511d15294d1a406a177368804014313948e2601 and 06fde31494c279ad940149e1a3d4944040c73c0d (inclusive) are affected. Versions prior to the introduction commit and versions after the fix commit are not affected.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and Vulert will analyze it in real-time.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache-commons-io.
