Veracode Software Composition Analysis

Attribute	Details
Library	Apache Commons Collections
Description	The Apache Commons Collections package contains types that extend and augment the Java Collections Framework.
Language	JAVA
Vulnerability	Potential Remote Code Execution Via Java Object Deserialization
Vulnerability description	Apache Commons includes a class called InvokerTransformer. An application is vulnerable to a deserialization attack if this class is available on the classpath and the application deserializes untrusted or user-supplied data. It's not necessary to actually use InvokerTransfomer to be vulnerable. With these two criteria satisfied, an attacker may construct a gadget chain using classes in the component to execute arbitrary code. The chain relies on the class InvokerTransformer in the org.apache.commons.collections.functors package to invoke methods during the deserialization process.

The fix prevents deserialization of InvokerTransformer by default unless it's specifically enabled.

Links:

5l1D3R / Github-actions