Skip to content

Commit 276d8c2

Browse files
committed
Add CVE-2019-10086 to the site's security page
1 parent 2a230a8 commit 276d8c2

File tree

1 file changed

+77
-28
lines changed

1 file changed

+77
-28
lines changed

src/site/xdoc/security.xml

Lines changed: 77 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,10 @@
11
<?xml version="1.0"?>
2-
<!--
3-
Licensed to the Apache Software Foundation (ASF) under one
4-
or more contributor license agreements. See the NOTICE file
5-
distributed with this work for additional information
6-
regarding copyright ownership. The ASF licenses this file
7-
to you under the Apache License, Version 2.0 (the
8-
"License"); you may not use this file except in compliance
9-
with the License. You may obtain a copy of the License at
10-
11-
https://www.apache.org/licenses/LICENSE-2.0
12-
13-
Unless required by applicable law or agreed to in writing,
14-
software distributed under the License is distributed on an
15-
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
16-
KIND, either express or implied. See the License for the
17-
specific language governing permissions and limitations
18-
under the License.
19-
-->
20-
<document xmlns="http://maven.apache.org/XDOC/2.0"
21-
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
2+
<!-- Licensed to the Apache Software Foundation (ASF) under one or more contributor license agreements. See the NOTICE file distributed with this work for additional information regarding
3+
copyright ownership. The ASF licenses this file to you under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may
4+
obtain a copy of the License at https://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed
5+
on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the
6+
License. -->
7+
<document xmlns="http://maven.apache.org/XDOC/2.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
228
xsi:schemaLocation="http://maven.apache.org/XDOC/2.0 https://maven.apache.org/xsd/xdoc-2.0.xsd">
239
<properties>
2410
<title>Apache Commons Security Reports</title>
@@ -28,24 +14,87 @@
2814
<section name="About Security">
2915
<p>
3016
For information about reporting or asking questions about security, please see
31-
<a href="https://commons.apache.org/security.html">Apache Commons Security</a>.
17+
<a href="https://commons.apache.org/security.html">Apache Commons Security</a>
18+
.
3219
</p>
33-
<p>This page lists all security vulnerabilities fixed in released versions of this component.
20+
<p>This page lists all security vulnerabilities fixed in released versions of this component.
3421
</p>
3522
<p>Please note that binary patches are never provided. If you need to apply a source code patch, use the building instructions for the component version
36-
that you are using.
23+
that you are using.
3724
</p>
3825
<p>
3926
If you need help on building this component or other help on following the instructions to mitigate the known vulnerabilities listed here, please send
40-
your questions to the public
41-
<a href="mail-lists.html">user mailing list</a>.
27+
your questions to the
28+
public
29+
<a href="mail-lists.html">user mailing list</a>
30+
.
4231
</p>
4332
<p>If you have encountered an unlisted security vulnerability or other unexpected behavior that has security impact, or if the descriptions here are
44-
incomplete, please report them privately to the Apache Security Team. Thank you.
33+
incomplete, please report
34+
them privately to the Apache Security Team. Thank you.
4535
</p>
4636
</section>
4737
<section name="Security Vulnerabilities">
48-
<p>None.</p>
38+
<subsection name="CVE-2019-10086">
39+
<ul>
40+
<li>CVE-2019-10086: Apache Commons Beanutils does not suppresses the class property in PropertyUtilsBean by default.</li>
41+
<li>Severity: Medium</li>
42+
<li>Vendor: The Apache Software Foundation</li>
43+
<li>Versions Affected: commons-beanutils-1.9.3 and earlier</li>
44+
<li>Description: A special BeanIntrospector class was added in version 1.9.2.
45+
This can be used to stop attackers from using the class property of
46+
Java objects to get access to the classloader.
47+
However this protection was not enabled by default.
48+
PropertyUtilsBean (and consequently BeanUtilsBean) now disallows class
49+
level property access by default, thus protecting against
50+
CVE-2014-0114.
51+
</li>
52+
53+
<li>Mitigation: 1.X users should migrate to 1.9.4.</li>
54+
55+
<li>Credit: This was discovered by Melloware (https://melloware.com/).</li>
56+
</ul>
57+
<p>
58+
Example:
59+
</p>
60+
<pre>
61+
/**
62+
* Example displaying the new default behavior such that
63+
* it is not possible to access class level properties utilizing the
64+
* BeanUtilsBean, which in turn utilizes the PropertyUtilsBean.
65+
*/
66+
public void testSuppressClassPropertyByDefault() throws Exception {
67+
final BeanUtilsBean bub = new BeanUtilsBean();
68+
final AlphaBean bean = new AlphaBean();
69+
try {
70+
bub.getProperty(bean, "class");
71+
fail("Could access class property!");
72+
} catch (final NoSuchMethodException ex) {
73+
// ok
74+
}
75+
}
76+
77+
/**
78+
* Example showing how by which one would use to revert to the
79+
* behaviour prior to the 1.9.4 release where class level properties were accessible by
80+
* the BeanUtilsBean and the PropertyUtilsBean.
81+
*/
82+
public void testAllowAccessToClassProperty() throws Exception {
83+
final BeanUtilsBean bub = new BeanUtilsBean();
84+
bub.getPropertyUtils().removeBeanIntrospector(SuppressPropertiesBeanIntrospector.SUPPRESS_CLASS);
85+
final AlphaBean bean = new AlphaBean();
86+
String result = bub.getProperty(bean, "class");
87+
assertEquals("Class property should have been accessed", "class org.apache.commons.beanutils2.AlphaBean", result);
88+
}
89+
</pre>
90+
<p>
91+
References:
92+
</p>
93+
<ol>
94+
<li>https://issues.apache.org/jira/browse/BEANUTILS-520</li>
95+
<li>http://commons.apache.org/proper/commons-beanutils/</li>
96+
</ol>
97+
</subsection>
4998
</section>
5099
</body>
51-
</document>
100+
</document>

0 commit comments

Comments
 (0)