CVE-2025-48924 Apache Commons Lang is vulnerable to Uncontrolled Recursion when processing long inputs (#111)

Author: vharseko

legal/THIRDPARTYREADME.txt

@@ -59,13 +59,7 @@ Copyright: Copyright 2002-2013 The Apache Software Foundation
 Version: commons-io-2.4.jar
 Copyright: Copyright 2002-2012 The Apache Software Foundation
 
-Version: commons-lang-2.4.jar
-Copyright: Copyright 2001-2008 The Apache Software Foundation
-
-Version: commons-lang-2.6.jar
-Copyright: Copyright 2001-2011 The Apache Software Foundation
-
-Version: commons-lang3-3.4.jar
+Version: commons-lang3-3.18.jar
 Copyright: Copyright 2001-2013 The Apache Software Foundation
 
 Version: commons-beanutils-1.8.0.jar

openidm-zip/pom.xml

@@ -22,7 +22,7 @@
   ~ your own identifying information:
   ~ "Portions Copyrighted [year] [name of copyright owner]"
   ~
-  ~ Portions Copyrighted 2024 3A Systems LLC.
+  ~ Portions Copyrighted 2019-2025 3A Systems LLC.
   -->
 <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
     <modelVersion>4.0.0</modelVersion>
@@ -658,9 +658,8 @@
             <version>3.2.2</version>
         </dependency>
         <dependency>
-            <groupId>commons-lang</groupId>
-            <artifactId>commons-lang</artifactId>
-            <version>2.6</version>
+            <groupId>org.apache.commons</groupId>
+            <artifactId>commons-lang3</artifactId>
         </dependency>
         <!-- Test Dependencies -->
         <dependency>

openidm-zip/src/main/assembly/zip.xml

@@ -13,7 +13,7 @@
   information: "Portions Copyrighted [year] [name of copyright owner]".
 
   Copyright (c) 2011-2016 ForgeRock AS. All rights reserved.
-  Portions Copyrighted 2019-2024 3A Systems LLC.
+  Portions Copyrighted 2019-2025 3A Systems LLC.
 -->
 <assembly xmlns="http://maven.apache.org/plugins/maven-assembly-plugin/assembly/1.1.2"
           xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
@@ -1278,7 +1278,7 @@
                 <include>com.jcraft:jsch</include>
                 <include>commons-beanutils:commons-beanutils</include>
                 <include>commons-collections:commons-collections</include>
-                <include>commons-lang:commons-lang</include>
+                <include>org.apache.commons:commons-lang3</include>
                 <include>net.sf.ezmorph:ezmorph</include>
                 <include>org.codehaus.groovy.modules.http-builder:http-builder</include>
                 <include>net.sf.json-lib:json-lib</include>