You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: src/changes/changes.xml
+1Lines changed: 1 addition & 0 deletions
Original file line number
Diff line number
Diff line change
@@ -35,6 +35,7 @@
35
35
</release>
36
36
<releaseversion="1.11.0"date="2025-05-25"description="This is a maintenance release and requires Java 8.">
37
37
<!-- FIX -->
38
+
<actiontype="fix"dev="ggregory"due-to="Raj, Muthukumar Marikani, Gary Gregory">CVE-2025-48734: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default (https://www.cve.org/CVERecord?id=CVE-2025-48734).</action>
38
39
<actiontype="fix"dev="ggregory"due-to="Gary Gregory">BeanComparator.compare(T, T) now throws IllegalArgumentException instead of RuntimeException to wrap all cases of ReflectiveOperationException.</action>
39
40
<actiontype="fix"dev="ggregory"due-to="Gary Gregory">MappedMethodReference.get() now throws IllegalStateException instead of RuntimeException to wrap cases of NoSuchMethodException.</action>
40
41
<actiontype="fix"dev="ggregory"due-to="Gary Gregory">ResultSetIterator.get(String) now throws IllegalArgumentException instead of RuntimeException to wrap cases of SQLException.</action>
<!-- Licensed to the Apache Software Foundation (ASF) under one or more contributor license agreements. See the NOTICE file distributed with this work for additional information regarding
3
+
copyright ownership. The ASF licenses this file to you under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may
4
+
obtain a copy of the License at https://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed
5
+
on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the
<p>This page lists all security vulnerabilities fixed in released versions of this component.
20
+
<p>This page lists all security vulnerabilities fixed in released versions of this component.
34
21
</p>
35
22
<p>Please note that binary patches are never provided. If you need to apply a source code patch, use the building instructions for the component version
36
-
that you are using.
23
+
that you are using.
37
24
</p>
38
25
<p>
39
26
If you need help on building this component or other help on following the instructions to mitigate the known vulnerabilities listed here, please send
40
-
your questions to the public
41
-
<ahref="mail-lists.html">user mailing list</a>.
27
+
your questions to the
28
+
public
29
+
<ahref="mail-lists.html">user mailing list</a>
30
+
.
42
31
</p>
43
32
<p>If you have encountered an unlisted security vulnerability or other unexpected behavior that has security impact, or if the descriptions here are
44
-
incomplete, please report them privately to the Apache Security Team. Thank you.
33
+
incomplete, please report
34
+
them privately to the Apache Security Team. Thank you.
45
35
</p>
46
36
</section>
47
37
<sectionname="Security Vulnerabilities">
48
-
<p>None.</p>
38
+
<subsectionname="CVE-2019-10086">
39
+
<ul>
40
+
<li>CVE-2019-10086: Apache Commons Beanutils does not suppresses the class property in PropertyUtilsBean by default.</li>
41
+
<li>Severity: Medium</li>
42
+
<li>Vendor: The Apache Software Foundation</li>
43
+
<li>Versions Affected: commons-beanutils-1.9.3 and earlier</li>
44
+
<li>Description: A special BeanIntrospector class was added in version 1.9.2.
45
+
This can be used to stop attackers from using the class property of
46
+
Java objects to get access to the classloader.
47
+
However this protection was not enabled by default.
48
+
PropertyUtilsBean (and consequently BeanUtilsBean) now disallows class
49
+
level property access by default, thus protecting against
50
+
CVE-2014-0114.
51
+
</li>
52
+
<li>Mitigation: 1.X users should migrate to 1.9.4.</li>
53
+
<li>Credit: This was discovered by Melloware (https://melloware.com/).</li>
54
+
</ul>
55
+
<p>
56
+
Example:
57
+
</p>
58
+
<pre>
59
+
/**
60
+
* Example displaying the new default behavior such that
61
+
* it is not possible to access class level properties utilizing the
62
+
* BeanUtilsBean, which in turn utilizes the PropertyUtilsBean.
63
+
*/
64
+
public void testSuppressClassPropertyByDefault() throws Exception {
65
+
final BeanUtilsBean bub = new BeanUtilsBean();
66
+
final AlphaBean bean = new AlphaBean();
67
+
try {
68
+
bub.getProperty(bean, "class");
69
+
fail("Could access class property!");
70
+
} catch (final NoSuchMethodException ex) {
71
+
// ok
72
+
}
73
+
}
74
+
75
+
/**
76
+
* Example showing how by which one would use to revert to the
77
+
* behaviour prior to the 1.9.4 release where class level properties were accessible by
78
+
* the BeanUtilsBean and the PropertyUtilsBean.
79
+
*/
80
+
public void testAllowAccessToClassProperty() throws Exception {
<li><ahref="https://www.cve.org/CVERecord?id=CVE-2025-48734">CVE-2025-48734</a>: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default</li>
99
+
<li>Severity: important</li>
100
+
<li>Affected versions: 1.x 1.0 before 1.11.0</li>
101
+
<li>Affected versions: 2.x 2.0.0-M1 before 2.0.0-M2</li>
102
+
<li>Description: Improper Access Control vulnerability in Apache Commons.
103
+
A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this protection was not enabled by default. PropertyUtilsBean (and consequently BeanUtilsBean) now disallows declared class level property access by default.
104
+
Releases 1.11.0 and 2.0.0-M2 address a potential security issue when accessing enum properties in an uncontrolled way. If an application using Commons BeanUtils passes property paths from an external source directly to the getProperty() method of PropertyUtilsBean, an attacker can access the enum’s class loader via the “declaredClass” property available on all Java “enum” objects. Accessing the enum’s “declaredClass” allows remote attackers to access the ClassLoader and execute arbitrary code. The same issue exists with PropertyUtilsBean.getNestedProperty().
105
+
Starting in versions 1.11.0 and 2.0.0-M2 a special BeanIntrospector suppresses the “declaredClass” property. Note that this new BeanIntrospector is enabled by default, but you can disable it to regain the old behavior; see section 2.5 of the user's guide and the unit tests.
106
+
This issue affects Apache Commons BeanUtils 1.x before 1.11.0, and 2.x before 2.0.0-M2.
107
+
</li>
108
+
<li>Mitigation: Users of the artifact commons-beanutils:commons-beanutils 1.x are recommended to upgrade to version 1.11.0, which fixes the issue.</li>
109
+
<li>Mitigation: Users of the artifact org.apache.commons:commons-beanutils2 2.x are recommended to upgrade to version 2.0.0-M2, which fixes the issue.</li>
0 commit comments