Resource exhaustion in Apache Commons IO - CVE-2024-47554

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU98025

Resource exhaustion in Apache Commons IO - CVE-2024-47554

Published: October 3, 2024 / Updated: March 11, 2025


Vulnerability identifier: #VU98025
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-47554
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when handling untrusted input passed to the org.apache.commons.io.input.XmlStreamReader class. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.


Affected software

Apache Commons IO
Oracle Agile PLM Framework
IBM App Connect Enterprise
WebSphere Service Registry and Repository
Log Analysis
Netcool Operations Insight
IBM Sterling B2B Integrator
IBM Sterling Control Center
IBM Sterling Partner Engagement Manager
IBM Tivoli Netcool Impact
Oracle Communications IP Service Activator
Oracle Communications Unified Inventory Management
Netcool/OMNIbus
Oracle Financial Services Model Management and Governance
IBM Maximo Application Suite - Manage Component
Oracle Communications Diameter Signaling Router
IBM Transformation Extender Advanced
Infrastructure Technology
Oracle Policy Modeling
Oracle Middleware Common Libraries and Tools
Oracle WebCenter Forms Recognition
Oracle Banking APIs
Oracle Communications Network Analytics Data Director
Oracle Communications Cloud Native Core Binding Support Function
Oracle Communications Cloud Native Core Network Repository Function
Oracle Communications EAGLE Element Management System
IBM Observability with Instana
Jazz for Service Management
IBM Cloud Pak for Security
IBM Process Mining
IBM Cloud Object Storage Systems
IBM Watson Assistant for IBM Cloud Pak for Data
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
App Connect Enterprise Certified Container
IBM Tivoli Netcool/OMNIbus WebGUI
IBM Cloud Application Performance Management (APM)
IBM SPSS Collaboration and Deployment Services
WebSphere eXtreme Scale
IBM Cloud Pak for Business Automation
IBM Business Automation Workflow
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 15 SP3
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Software Development Kit 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
Oracle Solaris Cluster
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Enterprise Storage
Ubuntu
Basesystem Module
openSUSE Leap
Anolis OS
openEuler
Fedora
Astronomer with IBM
Library Support for Struts
Guardium Data Security Center (GDSC)
IBM Cloud Pak for Watson AIOps
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
Knowledge Catalog Premium Cartridge
Oracle Agile Engineering Data Management
Engineering Test Management
Oracle Business Intelligence Enterprise Edition
Oracle Financial Services Analytical Applications Infrastructure
IBM InfoSphere Identity Insight
IBM Business Automation Manager Open Editions
IBM Engineering Systems Design Rhapsody
IBM Engineering Requirements Management DOORS Next
Rational Developer for i
Oracle Policy Automation
Oracle Retail Service Backbone
Oracle Communications Policy Management
Oracle Retail Store Inventory Management
Oracle Retail Xstore Point of Service
Oracle Retail Order Broker
Dell Data Protection Central
Oracle Banking Digital Experience
IBM Application Suite - IBM Asset Data Dictionary Component
PowerVM NovaLink
Cloudera Observability with IBM
watsonx Assistant for IBM Cloud Pak for Data
User Entity Behavior Analytics
DataStage on Cloud Pak for Data
Cognos Dashboards on Cloud Pak for Data
IBM Secure External Authentication Server
IBM Engineering Lifecycle Optimization - Publishing
Engineering Lifecycle Management - Jazz Foundation
MobileFirst Platform
Maximo Application Suite - IoT Component
Maximo Application Suite - Predict Component
Integration Bus for z/OS
Robotic Process Automation for Cloud Pak
Business Automation Insights
IBM Disconnected Log Collector
OSS Support Tools
JD Edwards EnterpriseOne Tools
Primavera Unifier
Oracle Communications Convergence
Communications Unified Assurance
Oracle Communications MetaSolv Solution
Communications Service Catalog and Design
Oracle Communications Calendar Server
Oracle Communications Contacts Server
Oracle Communications Instant Messaging Server
Oracle Communications Offline Mediation Controller
Oracle Communications Billing and Revenue Management
Oracle Health Sciences Information Manager
Oracle Utilities Application Framework
Oracle Utilities Testing Accelerator
Oracle Insurance Policy Administration
Oracle Fusion Middleware MapViewer
Oracle SOA Suite
Oracle Business Activity Monitoring
Oracle Retail Price Management
Oracle Communications Order and Service Management
RSA Authentication Manager
IBM Qradar SIEM
Jazz Reporting Service
IBM Cognos Controller
Oracle Commerce Guided Search
Oracle Retail Merchandising System
Oracle Communications Pricing Design Center
Oracle WebCenter Portal
Oracle Hospitality Cruise Shipboard Property Management System
Siebel Apps - Marketing
Siebel CRM Deployment
Oracle WebLogic Server
Primavera Gateway
AMQ Streams
Oracle Service Bus
Oracle Documaker
Planning Analytics Local
Operational Decision Manager
Oracle Retail Integration Bus
Oracle TimesTen In-Memory Database
IBM InfoSphere Information Server
Oracle Communications Cloud Native Core Policy
Oracle Communications Cloud Native Core Console
Oracle Communications Cloud Native Core Security Edge Protection Proxy
watsonx.data
commons-io (Ubuntu package)
apache-commons-io
apache-commons-io-help
apache-commons-io-javadoc

How to mitigate CVE-2024-47554

Install updates from vendor's website.

Apache Commons IO - update to 2.14.0
Astronomer with IBM - update to 1.0.1
Log Analysis - update to 1.3.8.2
Netcool Operations Insight - update to 1.6.15
IBM Disconnected Log Collector - update to 1.8.7
Guardium Data Security Center (GDSC) - update to 3.6.1
IBM Cloud Pak for Watson AIOps - update to 4.10.0
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data - update to 5.2
Knowledge Catalog Premium Cartridge - update to 5.2
IBM Sterling B2B Integrator - addressed in versions 6.1.2.7, 6.2.0.4
IBM Sterling Control Center - addressed in versions 6.2.1.0.15, 6.3.1.0.4
IBM Sterling Partner Engagement Manager - addressed in versions 6.2.3.5, 6.2.4.2
Engineering Test Management - addressed in versions 7.0.3.0.18, 7.1.0.0.5
IBM Tivoli Netcool Impact - update to 7.1.0.37
IBM Qradar SIEM - update to 7.5.0 Update Pack 13
Netcool/OMNIbus - update to 8.1.0.35
IBM Maximo Application Suite - Manage Component - addressed in versions 8.6.27, 8.7.21, 9.0.14
RSA Authentication Manager - update to 8.7 SP2 Patch 6
IBM Business Automation Manager Open Editions - update to 9.2.1
IBM Engineering Systems Design Rhapsody - addressed in versions 9.0.2.0.4, 10.0.0.2, 10.0.1.2
IBM Engineering Requirements Management DOORS Next - update to 9.7.2.11
IBM Transformation Extender Advanced - addressed in versions 10.0.1.11, 10.0.2.0
Oracle Policy Automation - update to 12.2.37
Oracle Policy Modeling - update to 12.2.37
Dell Data Protection Central - update to 19.12.0-2
Siebel Apps - Marketing - update to 25.7
Siebel CRM Deployment - update to 25.8
IBM Observability with Instana - update to 1.0.292
Jazz for Service Management - update to 1.1.3.23
IBM Application Suite - IBM Asset Data Dictionary Component - update to 1.1.15
IBM Cloud Pak for Security - update to 1.11.0.0
IBM Process Mining - update to 1.15.0 IF004
AMQ Streams - update to 2
Planning Analytics Local - addressed in versions 2.0.0.101, 2.1.8
watsonx.data - update to 2.1
PowerVM NovaLink - addressed in versions 2.1.1-250103, 2.2.1.1-250103, 2.3.0-250103
commons-io (Ubuntu package) - addressed in versions 2.4-2ubuntu0.1~esm2, 2.4-2ubuntu0.16.04.1~esm1, 2.6-2ubuntu0.18.04.1+esm1, 2.6-2ubuntu0.20.04.1+esm1, 2.11.0-2ubuntu0.22.04.1~esm1, 2.11.0-2ubuntu0.24.04.1~esm1
apache-commons-io - update to 2.11.0-5.fc39
apache-commons-io - update to 2.15.1-1
apache-commons-io-help - update to 2.15.1-1
apache-commons-io - update to 2.16.1-1
apache-commons-io-javadoc - update to 2.16.1-1
apache-commons-io - addressed in versions 2.17.0-11.3.1, 2.18.0-150200.3.15.1
apache-commons-io-javadoc - update to 2.18.0-150200.3.15.1
Cloudera Observability with IBM - update to 3.6.2
IBM Cloud Object Storage Systems - addressed in versions 3.18.0.84, 3.18.5.40
IBM Watson Assistant for IBM Cloud Pak for Data - update to 4.8.8
IBM Watson Discovery for IBM Cloud Pak for Data - addressed in versions 4.8.8, 5.1.1
watsonx Assistant for IBM Cloud Pak for Data - update to 4.8.8
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.8.9
User Entity Behavior Analytics - update to 5.0.2
App Connect Enterprise Certified Container - addressed in versions 5.0.20, 12.0.1, 12.2.0
DataStage on Cloud Pak for Data - update to 5.1.0.0.1
Cognos Dashboards on Cloud Pak for Data - update to 5.1.1
IBM Secure External Authentication Server - addressed in versions 6.0.3.1 iFix 03, 6.1.0.2 iFix 03
Jazz Reporting Service - addressed in versions 7.0.1 iFix005, 7.0.2 iFix0036, 7.0.3 iFix0018
IBM Engineering Lifecycle Optimization - Publishing - addressed in versions 7.0.2.32, 7.0.3.10
Engineering Lifecycle Management - Jazz Foundation - addressed in versions 7.0.3 iFix022, 7.1.0 iFix009
MobileFirst Platform - update to 8.0.0.0-MFPF-IF202501270630
IBM Tivoli Netcool/OMNIbus WebGUI - update to 8.1.0.34
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.17
IBM SPSS Collaboration and Deployment Services - update to 8.5.0.0.23
WebSphere eXtreme Scale - update to 8.6.1.6 PH65060 iFix
Maximo Application Suite - IoT Component - addressed in versions 8.7.19, 8.8.15, 9.0.5
Operational Decision Manager - update to 8.11.0.1 Interim fix 037
Maximo Application Suite - Predict Component - update to 9.0.3
Integration Bus for z/OS - update to 10.1.0.5
IBM Cognos Controller - addressed in versions 11.0.1.4, 11.1.0.2
IBM InfoSphere Information Server - update to 11.7.1 Fix Pack 5
IBM App Connect Enterprise - update to 12.0.12.8
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3-IF039, 24.0.0-IF004, 24.0.1
IBM Business Automation Workflow - addressed in versions 21.0.3-IF039, 24.0.0-IF004
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.19, 23.0.19
Business Automation Insights - addressed in versions 24.0.0.0.2, 24.0.1.0.1

External References

Related Security Bulletins