oss-security - CVE-2024-29133: Apache Commons Configuration: StackOverflowError calling ListDelimiterHandler.flatten(Object, int) with a cyclical object tree

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <0c244677-91ec-c056-17d2-d3a291086ae4@apache.org>
Date: Wed, 20 Mar 2024 21:53:35 +0000
From: "Gary D. Gregory" <ggregory@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2024-29133: Apache Commons Configuration: StackOverflowError
 calling ListDelimiterHandler.flatten(Object, int) with a cyclical object
 tree 

Severity: low

Affected versions:

- Apache Commons Configuration 2.0 before 2.10.1

Description:

Out-of-bounds Write vulnerability in Apache Commons Configuration.This issue affects Apache Commons Configuration: from 2.0 before 2.10.1.

Users are recommended to upgrade to version 2.10.1, which fixes the issue.

This issue is being tracked as CONFIGURATION-841 

Credit:

Gary Gregory (finder)

References:

https://commons.apache.org/
https://www.cve.org/CVERecord?id=CVE-2024-29133
https://issues.apache.org/jira/browse/CONFIGURATION-841

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.