Out-of-bounds write in Apache Commons Configuration - CVE-2024-29133

Vulnerability identifier: #VU87744

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-29133

CWE-ID: CWE-787

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when calling the ListDelimiterHandler.flatten(Object, int) with a cyclical object tree. A remote attacker can pass specially crafted input to the application, trigger an out-of-bounds write and execute arbitrary code on the target system.

Apache Commons Configuration
Confluence Data Center
IBM Cloud Transformation Advisor
Oracle Banking Party Management
IBM Security Guardium Key Lifecycle Manager (GKLM)
SAP BusinessObjects Business Intelligence suite
Oracle Financial Services Model Management and Governance
WebSphere Remote Server
IBM Security Verify Governance
Migration Toolkit for Runtimes
Log Analysis
IBM Cloud Object Storage Systems
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Watson Assistant for IBM Cloud Pak for Data
IBM Tivoli Business Service Manager
IBM Sterling Control Center
Red Hat Migration Toolkit for Applications
IBM Cloud Application Performance Management (APM)
WebSphere eXtreme Scale
IBM Common Licensing
IBM Cloud Pak for Business Automation
Confluence Server
Guardium Data Security Center (GDSC)
DataStage on Cloud Pak for Data
Oracle Business Intelligence Enterprise Edition
Db2 Big SQL
IBM OpenPages with Watson
Datacap
IBM Application Suite - IBM Asset Data Dictionary Component
Analytics Content Hub
User Entity Behavior Analytics
Cognos Dashboards on Cloud Pak for Data
IBM Sterling Connect:Direct for Microsoft Windows
Storage Protect Server
Communications Unified Assurance
Oracle Communications Order and Service Management
Oracle Financial Services Compliance Studio
Oracle Communications BRM - Elastic Charging Engine
IBM DB2
Fedora
IBM Cloud Pak System
apache-commons-configuration
Jazz Reporting Service
IBM Cognos Command Center
AMQ Broker

Install updates from vendor's website.

Apache Commons Configuration - update to 2.10.1
Confluence Data Center - addressed in versions 7.19.23, 8.5.9, 8.9.1
Confluence Server - addressed in versions 7.19.23, 8.5.9, 8.9.1
IBM Cloud Transformation Advisor - update to 3.10.2
Guardium Data Security Center (GDSC) - update to 3.8.5
DataStage on Cloud Pak for Data - update to 5.0.0
Db2 Big SQL - update to 7.6.8
Oracle Communications BRM - Elastic Charging Engine - update to 12.0.0.8.0
IBM Application Suite - IBM Asset Data Dictionary Component - update to 1.1.15
Migration Toolkit for Runtimes - update to 1.2.6
Log Analysis - update to 1.3.8.0
Analytics Content Hub - update to 2.3
IBM Cloud Pak System - addressed in versions 2.3.4.1, 2.3.5.0
apache-commons-configuration - update to 2.10.1-1.fc39
IBM Cloud Object Storage Systems - addressed in versions 3.20.0.43, 3.20.0.69
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.8.5
IBM Watson Assistant for IBM Cloud Pak for Data - update to 5.0
User Entity Behavior Analytics - update to 5.0.2
Cognos Dashboards on Cloud Pak for Data - update to 5.1
IBM Sterling Connect:Direct for Microsoft Windows - addressed in versions 6.0.0.4.88, 6.1.0.2.87, 6.2.0.6.20, 6.3.0.3.4
IBM Tivoli Business Service Manager - update to 6.2.0.5.5
IBM Sterling Control Center - addressed in versions 6.2.1.0.14, 6.3.1.0.3
Red Hat Migration Toolkit for Applications - update to 6.2.3
Jazz Reporting Service - addressed in versions 7.0.3 iFix009, 7.02 iFix031
AMQ Broker - update to 7.12.0
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.4
Storage Protect Server - update to 8.1.24
WebSphere eXtreme Scale - update to 8.6.1.6 PH61029 iFix
IBM Common Licensing - update to 9.0.0.1
IBM Cognos Command Center - update to 10.2.5 IF2
IBM DB2 - addressed in versions 11.1.4.7, 11.5.8, 11.5.9
IBM Cloud Pak for Business Automation - addressed in versions 24.0.0-IF004, 24.0.1-IF001

• https://lists.apache.org/thread/ccb9w15bscznh6tnp3wsvrrj9crbszh2

• Remote code execution in Apache Commons Configuration
• Fedora 39 update for apache-commons-configuration
• Multiple vulnerabilities in IBM Cognos Command Center
• Multiple vulnerabilities in IBM WebSphere Extreme Scale
• Multiple vulnerabilities in IBM Watson Discovery
• Multiple vulnerabilities in Migration Toolkit for Runtimes 1.2
• Multiple vulnerabilities in AMQ Broker 7.12
• Confluence Data Center and Server update for third-party software
• Multiple vulnerabilities in Red Hat Migration Toolkit for Applications 6.2
• Multiple vulnerabilities in IBM Db2
• Multiple vulnerabilities in IBM Sterling Connect:Direct for Microsoft Windows
• Multiple vulnerabilities in IBM Watson Assistant for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Operations Analytics - Log Analysis
• Multiple vulnerabilities in Oracle Communications BRM - Elastic Charging Engine
• Out-of-bounds write in Oracle Banking Party Management
• Multiple vulnerabilities in Oracle Financial Services Compliance Studio
• Multiple vulnerabilities in Oracle Financial Services Model Management and Governance
• Multiple vulnerabilities in IBM WebSphere Remote Server
• Multiple vulnerabilities in IBM Cloud APM
• Multiple vulnerabilities in IBM OpenPages with Watson
• Multiple vulnerabilities in IBM Security Guardium Key Lifecycle Manager
• Multiple vulnerabilities in IBM Security Verify Governance
• Multiple vulnerabilities in IBM Common Licensing
• Multiple vulnerabilities in Datacap
• Multiple vulnerabilities in IBM Tivoli Business Service Manager
• Out-of-bounds write in Oracle Communications Order and Service Management
• Multiple vulnerabilities in Oracle Business Intelligence Enterprise Edition
• Multiple vulnerabilities in IBM Storage Protect Server
• Multiple vulnerabilities in IBM Jazz Reporting Service
• Multiple vulnerabilities in IBM Cloud Pak System
• Multiple vulnerabilities in IBM Control Center
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Multiple vulnerabilities in IBM Analytics Content Hub
• Multiple vulnerabilities in SAP BusinessObjects Business Intelligence Platform Crystal Reports for Enterprise
• Multiple vulnerabilities in Communications Unified Assurance
• Multiple vulnerabilities in IBM Asset Data Dictionary Component
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Multiple vulnerabilities in IBM DataStage on Cloud Pak for Data
• Multiple vulnerabilities in IBM Cognos Dashboards on Cloud Pak for Data
• Multiple vulnerabilities in IBM User Entity Behavior Analytics
• Multiple vulnerabilities in IBM Guardium Data Security Center
• Multiple vulnerabilities in IBM Big SQL on IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Cloud Object System