Skip to content

Commit b57a280

Browse files
ppkarwaszppkarwasz
authored
feat: Add experimental CycloneDX VEX file (#683)
* feat: Add experimental CycloneDX VEX file This commit introduces an experimental CycloneDX VEX document that: * Provides an analysis of **CVE-2025-48924** as it pertains to this library. * Is committed to the **Git repository only** (not published to Maven Central), allowing it to be retrieved via `raw.githubusercontent.com`. This VEX file is intended to support consumers in evaluating the exploitability of known vulnerabilities in Apache Commons Text. * fix: Move files and fix copy/paste problems Moves files as suggested in apache/commons-bcel#446 and fixes copy/paste mistakes.
1 parent 9d0124b commit b57a280

File tree

2 files changed

+185
-0
lines changed

2 files changed

+185
-0
lines changed

‎src/conf/security/README.md‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
<!--
2+
~ Licensed to the Apache Software Foundation (ASF) under one or more
3+
~ contributor license agreements. See the NOTICE file distributed with
4+
~ this work for additional information regarding copyright ownership.
5+
~ The ASF licenses this file to you under the Apache License, Version 2.0
6+
~ (the "License"); you may not use this file except in compliance with
7+
~ the License. You may obtain a copy of the License at
8+
~
9+
~ http://www.apache.org/licenses/LICENSE-2.0
10+
~
11+
~ Unless required by applicable law or agreed to in writing, software
12+
~ distributed under the License is distributed on an "AS IS" BASIS,
13+
~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
~ See the License for the specific language governing permissions and
15+
~ limitations under the License.
16+
-->
17+
18+
# CycloneDX Documents for Apache Commons Text
19+
20+
The Apache Commons Text project publishes multiple [CycloneDX](https://cyclonedx.org/) documents to help consumers assess the security of their applications using this library:
21+
22+
## SBOM (Software Bill of Materials)
23+
24+
Beginning with version `6.6.0`, Apache Commons Text publishes SBOMs in both **XML** and **JSON** formats to Maven Central. These documents describe all components and dependencies of the library, following standard Maven coordinates:
25+
26+
* **Group ID:** `org.apache.commons`
27+
* **Artifact ID:** `commons-text`
28+
* **Classifier:** `cyclonedx`
29+
* **Type:** `xml` or `json`
30+
31+
Each SBOM lists the library’s required and optional dependencies, helping consumers analyze the software supply chain and manage dependency risk.
32+
33+
> [!NOTE]
34+
> The versions listed in the SBOM reflect the dependencies used during the build and test process for that specific release of Text.
35+
> Your own project may use different versions depending on your dependency management configuration.
36+
37+
## VEX (Vulnerability Exploitability eXchange)
38+
39+
An experimental [VEX](https://cyclonedx.org/capabilities/vex/) document is also published:
40+
41+
👉 [`https://raw.githubusercontent.com/apache/commons-text/refs/heads/master/src/conf/security/VEX.cyclonedx.xml`](VEX.cyclonedx.xml)
42+
43+
This document provides information about the **exploitability of known vulnerabilities** in the **dependencies** of Apache Commons Text.
44+
45+
### When is a dependency vulnerability exploitable?
46+
47+
Because Apache Commons libraries (including Text) do **not** bundle their dependencies, a vulnerability in a dependency is only exploitable if **both** of the following conditions are true:
48+
49+
1. The vulnerable dependency is included in the consuming project.
50+
2. Apache Commons Text is explicitly listed as affected by the vulnerability.
51+
52+
### Notes and Limitations
53+
54+
* This VEX document is **experimental** and provided **as-is**.
55+
The semantics of this document may change in the future.
56+
* The **absence** of a vulnerability entry does **not** indicate that Text is unaffected.
57+
* If a version of Text is not listed under the `affects` section of a vulnerability, that version may still be affected or not.
58+
* Only the **latest major version** of Text is currently assessed for vulnerabilities.
59+
* The `analysis` field in the VEX file uses **Markdown** formatting.
60+
61+
For more information about CycloneDX, SBOMs, or VEX, visit [cyclonedx.org](https://cyclonedx.org/).

‎src/conf/security/VEX.cyclonedx.xml‎

Lines changed: 124 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,124 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!--
3+
~ Licensed to the Apache Software Foundation (ASF) under one or more
4+
~ contributor license agreements. See the NOTICE file distributed with
5+
~ this work for additional information regarding copyright ownership.
6+
~ The ASF licenses this file to you under the Apache License, Version 2.0
7+
~ (the "License"); you may not use this file except in compliance with
8+
~ the License. You may obtain a copy of the License at
9+
~
10+
~ http://www.apache.org/licenses/LICENSE-2.0
11+
~
12+
~ Unless required by applicable law or agreed to in writing, software
13+
~ distributed under the License is distributed on an "AS IS" BASIS,
14+
~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
~ See the License for the specific language governing permissions and
16+
~ limitations under the License.
17+
-->
18+
<!--
19+
To update this document:
20+
1. Increment the `version` attribute in the <bom> element.
21+
2. Update the `timestamp` in the <metadata> section.
22+
-->
23+
<bom xmlns="http://cyclonedx.org/schema/bom/1.6"
24+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
25+
xsi:schemaLocation="http://cyclonedx.org/schema/bom/1.6 https://cyclonedx.org/schema/bom-1.6.xsd"
26+
serialNumber="urn:uuid:f70dec29-fc7d-41f2-8c60-97e9075e0e73"
27+
version="1">
28+
29+
<metadata>
30+
<timestamp>2025-07-29T12:26:42Z</timestamp>
31+
<component type="library" bom-ref="main_component">
32+
<group>org.apache.commons</group>
33+
<name>commons-text</name>
34+
<cpe>cpe:2.3:a:apache:commons_text:*:*:*:*:*:*:*:*</cpe>
35+
<purl>pkg:maven/org.apache.commons/commons-text?type=jar</purl>
36+
</component>
37+
<manufacturer>
38+
<name>The Apache Software Foundation</name>
39+
<url>https://commons.apache.org</url>
40+
<contact>
41+
<name>Apache Commons PMC</name>
42+
<email>[email protected]</email>
43+
</contact>
44+
<contact>
45+
<name>Apache Commons Security Team</name>
46+
<email>[email protected]</email>
47+
</contact>
48+
</manufacturer>
49+
</metadata>
50+
51+
<vulnerabilities>
52+
<vulnerability>
53+
<id>CVE-2025-48924</id>
54+
<references>
55+
<reference>
56+
<id>GHSA-j288-q9x7-2f5v</id>
57+
<source>
58+
<url>https://github.com/advisories/GHSA-j288-q9x7-2f5v</url>
59+
</source>
60+
</reference>
61+
</references>
62+
<analysis>
63+
<state>exploitable</state>
64+
<responses>
65+
<response>update</response>
66+
</responses>
67+
<detail>
68+
CVE-2025-48924 is exploitable in Apache Commons Text versions 1.5 and later, but only when all the following conditions are met:
69+
70+
* The consuming project includes a vulnerable version of Commons Text on the classpath.
71+
As of version `1.14.1`, Commons Text no longer references a vulnerable version of the `commons-lang3` library in its POM file.
72+
* Unvalidated or unsanitized user input is passed to the `StringSubstitutor` or `StringLookup` classes.
73+
* An interpolator lookup created via `StringLookupFactory.interpolatorLookup()` is used.
74+
75+
If these conditions are satisfied, an attacker may cause an infinite loop by submitting a specially crafted input such as `${const:...}`.
76+
</detail>
77+
<firstIssued>2025-07-29T12:26:42Z</firstIssued>
78+
<lastUpdated>2025-07-29T12:26:42Z</lastUpdated>
79+
</analysis>
80+
<affects>
81+
<target>
82+
<ref>main_component</ref>
83+
<versions>
84+
<version>
85+
<range><![CDATA[vers:maven/>=1.5|<2]]></range>
86+
<status>affected</status>
87+
</version>
88+
</versions>
89+
</target>
90+
</affects>
91+
</vulnerability>
92+
</vulnerabilities>
93+
94+
<annotations>
95+
<annotation>
96+
<annotator>
97+
<individual>
98+
<name>Apache Commons PMC</name>
99+
<email>[email protected]</email>
100+
</individual>
101+
</annotator>
102+
<timestamp>2025-07-29T12:26:42Z</timestamp>
103+
<text>
104+
This document provides information about the **exploitability of known vulnerabilities** in the **dependencies** of Apache Commons Text.
105+
106+
# When is a dependency vulnerability exploitable?
107+
108+
Because Apache Commons libraries do **not** bundle their dependencies, a vulnerability in a dependency is only exploitable if **both** of the following conditions are true:
109+
110+
1. The vulnerable dependency is included in the consuming project.
111+
2. Apache Commons Text is explicitly listed as affected by the vulnerability.
112+
113+
# Notes and Limitations
114+
115+
* This VEX document is **experimental** and provided **as-is**.
116+
The semantics of this document may change in the future.
117+
* The **absence** of a vulnerability entry does **not** indicate that Text is unaffected.
118+
* If a version of Text is not listed under the `affects` section of a vulnerability, that version may still be affected or not.
119+
* Only the **latest major version** of Text is currently assessed for vulnerabilities.
120+
* The `analysis` field in the VEX file uses **Markdown** formatting.
121+
</text>
122+
</annotation>
123+
</annotations>
124+
</bom>

0 commit comments

Comments
 (0)