Resource exhaustion in Apache Commons IO - CVE-2024-47554

Vulnerability identifier: #VU98025

CSH Severity: Medium

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

CVE-ID: CVE-2024-47554

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

Affected software:
Apache Commons IO
Oracle Agile PLM Framework
IBM App Connect Enterprise
WebSphere Service Registry and Repository
Log Analysis
Netcool Operations Insight
IBM Sterling B2B Integrator
IBM Sterling Control Center
IBM Sterling Partner Engagement Manager
IBM Tivoli Netcool Impact
Oracle Communications IP Service Activator
Oracle Communications Unified Inventory Management
Netcool/OMNIbus
Oracle Financial Services Model Management and Governance
IBM Maximo Application Suite - Manage Component
Oracle Communications Diameter Signaling Router
IBM Transformation Extender Advanced
Infrastructure Technology
Oracle Policy Modeling
Oracle Middleware Common Libraries and Tools
Oracle WebCenter Forms Recognition
Oracle Banking APIs
Oracle Communications Network Analytics Data Director
Oracle Communications Cloud Native Core Binding Support Function
Oracle Communications Cloud Native Core Network Repository Function
Oracle Communications EAGLE Element Management System
IBM Observability with Instana
Jazz for Service Management
IBM Cloud Pak for Security
IBM Process Mining
IBM Cloud Object Storage Systems
IBM Watson Assistant for IBM Cloud Pak for Data
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
App Connect Enterprise Certified Container
IBM Tivoli Netcool/OMNIbus WebGUI
IBM Cloud Application Performance Management (APM)
IBM SPSS Collaboration and Deployment Services
WebSphere eXtreme Scale
IBM Cloud Pak for Business Automation
IBM Business Automation Workflow
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 15 SP3
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Software Development Kit 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
Oracle Solaris Cluster
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Enterprise Storage
Ubuntu
Basesystem Module
openSUSE Leap
Anolis OS
openEuler
Fedora
Astronomer with IBM
Library Support for Struts
Guardium Data Security Center (GDSC)
IBM Cloud Pak for Watson AIOps
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
Knowledge Catalog Premium Cartridge
Oracle Agile Engineering Data Management
Engineering Test Management
Oracle Business Intelligence Enterprise Edition
Oracle Financial Services Analytical Applications Infrastructure
IBM InfoSphere Identity Insight
IBM Business Automation Manager Open Editions
IBM Engineering Systems Design Rhapsody
IBM Engineering Requirements Management DOORS Next
Rational Developer for i
Oracle Policy Automation
Oracle Retail Service Backbone
Oracle Communications Policy Management
Oracle Retail Store Inventory Management
Oracle Retail Xstore Point of Service
Oracle Retail Order Broker
Dell Data Protection Central
Oracle Banking Digital Experience
IBM Application Suite - IBM Asset Data Dictionary Component
PowerVM NovaLink
Cloudera Observability with IBM
watsonx Assistant for IBM Cloud Pak for Data
User Entity Behavior Analytics
DataStage on Cloud Pak for Data
Cognos Dashboards on Cloud Pak for Data
IBM Secure External Authentication Server
IBM Engineering Lifecycle Optimization - Publishing
Engineering Lifecycle Management - Jazz Foundation
MobileFirst Platform
Maximo Application Suite - IoT Component
Maximo Application Suite - Predict Component
Integration Bus for z/OS
Robotic Process Automation for Cloud Pak
Business Automation Insights
IBM Disconnected Log Collector
OSS Support Tools
JD Edwards EnterpriseOne Tools
Primavera Unifier
Oracle Communications Convergence
Communications Unified Assurance
Oracle Communications MetaSolv Solution
Communications Service Catalog and Design
Oracle Communications Calendar Server
Oracle Communications Contacts Server
Oracle Communications Instant Messaging Server
Oracle Communications Offline Mediation Controller
Oracle Communications Billing and Revenue Management
Oracle Health Sciences Information Manager
Oracle Utilities Application Framework
Oracle Utilities Testing Accelerator
Oracle Insurance Policy Administration
Oracle Fusion Middleware MapViewer
Oracle SOA Suite
Oracle Business Activity Monitoring
Oracle Retail Price Management
Oracle Communications Order and Service Management
RSA Authentication Manager
IBM Qradar SIEM
Jazz Reporting Service
IBM Cognos Controller
Oracle Commerce Guided Search
Oracle Retail Merchandising System
Oracle Communications Pricing Design Center
Oracle WebCenter Portal
Oracle Hospitality Cruise Shipboard Property Management System
Siebel Apps - Marketing
Siebel CRM Deployment
Oracle WebLogic Server
Primavera Gateway
AMQ Streams
Oracle Service Bus
Oracle Documaker
Planning Analytics Local
Operational Decision Manager
Oracle Retail Integration Bus
Oracle TimesTen In-Memory Database
IBM InfoSphere Information Server
Oracle Communications Cloud Native Core Policy
Oracle Communications Cloud Native Core Console
Oracle Communications Cloud Native Core Security Edge Protection Proxy
watsonx.data
commons-io (Ubuntu package)
apache-commons-io
apache-commons-io-help
apache-commons-io-javadoc

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when handling untrusted input passed to the org.apache.commons.io.input.XmlStreamReader class. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Install updates from vendor's website.

• https://lists.apache.org/thread/xbkwfb64gy9rm09vmtj7872ws664os1y