Out-of-bounds Write vulnerability in Apache Commons Configuration.This issue affects Apache Commons Configuration: from 2.0 before 2.10.1.
Users are recommended to upgrade to version 2.10.1, which fixes the issue.
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2024-29131
### Vulnerable Library - commons-configuration2-2.1.1.jar
Tools to assist in the reading of configuration/preferences files in
various formats
Out-of-bounds Write vulnerability in Apache Commons Configuration.This issue affects Apache Commons Configuration: from 2.0 before 2.10.1.
Users are recommended to upgrade to version 2.10.1, which fixes the issue.
Vulnerable Library - commons-configuration2-2.1.1.jar
Tools to assist in the reading of configuration/preferences files in various formats
Library home page: http://commons.apache.org/proper/commons-configuration/
Path to dependency file: /nifi-nar-bundles/nifi-ranger-bundle/nifi-ranger-resources/pom.xml
Path to vulnerable library: /r/.m2/repository/org/apache/commons/commons-configuration2/2.1.1/commons-configuration2-2.1.1.jar
Vulnerabilities
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2024-29133
### Vulnerable Library - commons-configuration2-2.1.1.jarTools to assist in the reading of configuration/preferences files in various formats
Library home page: http://commons.apache.org/proper/commons-configuration/
Path to dependency file: /nifi-nar-bundles/nifi-ranger-bundle/nifi-ranger-resources/pom.xml
Path to vulnerable library: /r/.m2/repository/org/apache/commons/commons-configuration2/2.1.1/commons-configuration2-2.1.1.jar
Dependency Hierarchy: - :x: **commons-configuration2-2.1.1.jar** (Vulnerable Library)
Found in base branch: main
### Vulnerability DetailsOut-of-bounds Write vulnerability in Apache Commons Configuration.This issue affects Apache Commons Configuration: from 2.0 before 2.10.1. Users are recommended to upgrade to version 2.10.1, which fixes the issue.
Publish Date: 2024-03-21
URL: CVE-2024-29133
### CVSS 3 Score Details (4.4)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: Low - Availability Impact: Low
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://lists.apache.org/thread/ccb9w15bscznh6tnp3wsvrrj9crbszh2
Release Date: 2024-03-21
Fix Resolution: org.apache.commons:commons-configuration2:2.10.1
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.CVE-2024-29131
### Vulnerable Library - commons-configuration2-2.1.1.jarTools to assist in the reading of configuration/preferences files in various formats
Library home page: http://commons.apache.org/proper/commons-configuration/
Path to dependency file: /nifi-nar-bundles/nifi-ranger-bundle/nifi-ranger-resources/pom.xml
Path to vulnerable library: /r/.m2/repository/org/apache/commons/commons-configuration2/2.1.1/commons-configuration2-2.1.1.jar
Dependency Hierarchy: - :x: **commons-configuration2-2.1.1.jar** (Vulnerable Library)
Found in base branch: main
### Vulnerability DetailsOut-of-bounds Write vulnerability in Apache Commons Configuration.This issue affects Apache Commons Configuration: from 2.0 before 2.10.1. Users are recommended to upgrade to version 2.10.1, which fixes the issue.
Publish Date: 2024-03-21
URL: CVE-2024-29131
### CVSS 3 Score Details (4.4)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: Low - Availability Impact: Low
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://lists.apache.org/thread/03nzzzjn4oknyw5y0871tw7ltj0t3r37
Release Date: 2024-03-21
Fix Resolution: org.apache.commons:commons-configuration2:2.10.1
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.:rescue_worker_helmet:Automatic Remediation will be attempted for this issue.