This is an automated email from the ASF dual-hosted git repository. garydgregory pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/commons-bcel.git
commit f44a01c8d13d16b2952def0d1fbc4d9e63ac43fe Author: Gary Gregory <[email protected]> AuthorDate: Sat Oct 10 09:08:51 2026 -0400 Convert security page to Markdown --- src/site/markdown/security.md | 55 +++++++++++++++++++++++++++++++ src/site/xdoc/security.xml | 77 ------------------------------------------- 2 files changed, 55 insertions(+), 77 deletions(-) diff --git a/src/site/markdown/security.md b/src/site/markdown/security.md new file mode 100644 index 00000000..ee042ccd --- /dev/null +++ b/src/site/markdown/security.md @@ -0,0 +1,55 @@ +<!-- + Licensed to the Apache Software Foundation (ASF) under one + or more contributor license agreements. See the NOTICE file + distributed with this work for additional information + regarding copyright ownership. The ASF licenses this file + to you under the Apache License, Version 2.0 (the + "License"); you may not use this file except in compliance + with the License. You may obtain a copy of the License at + + https://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, + software distributed under the License is distributed on an + "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + KIND, either express or implied. See the License for the + specific language governing permissions and limitations + under the License. +--> + +# Apache Commons Security Reports + +## About Security + +For information about reporting or asking questions about security, please see [Apache Commons Security](https://commons.apache.org/security.html). + +This page lists all security vulnerabilities fixed in released versions of this component. + +Please note that binary patches are never provided. If you need to apply a source code patch, use the building instructions for the component version that you are using. + +If you need help on building this component or other help on following the instructions to mitigate the known vulnerabilities listed here, please send your questions to the public [user mailing list](mail-lists.html). + +If you have encountered an unlisted security vulnerability or other unexpected behavior that has security impact, or if the descriptions here are incomplete, please report them privately to the Apache Security Team. Thank you. + +## Security Model + +The [Apache Commons security model](https://commons.apache.org/security.html#Security_Model) specifies that it is unsafe to pass possibly malicious input to Commons libraries unless otherwise specified. For Commons BCEL, processing untrusted class data is supported to the extent that this should never allow the supplier of the data to trigger arbitrary code execution, filesystem or network access. It may still trigger other crashes, such as for example `StackOverflowError` or `OutOfMemor [...] + +## Security Vulnerabilities + +### CVE-2022-42920 + +- CVE-2022-42920: Apache Commons BCEL prior to 6.6.0 allows producing arbitrary bytecode via out-of-bounds writing. +- Severity: Critical +- CWE-ID: CWE-787 +- Vendor: The Apache Software Foundation +- Versions Affected: Apache Commons BCEL before 6.6.0. +- Description: Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds writing issue, these APIs can be used to produce arbitrary bytecode. This could be abused in applications that pass attacker-controllable data to those APIs, giving the attacker more control over the resulting bytecode than otherwise expected. Update to Apache Commons BCEL 6.6.0. +- Mitigation: Users are recommended to upgrade to version 6.6.0 or later, which fixes the issue. +- Credit: Reported by Felix Wilhelm (Google) +- Credit: GitHub pull request to Apache Commons BCEL #147 by Richard Atkins (https://github.com/rjatkins) +- Credit: PR derived from OpenJDK (https://github.com/openjdk/jdk11u/) commit 13bf52c8d876528a43be7cb77a1f452d29a21492 by Aleksei Voitylov and RealCLanger (Christoph Langer https://github.com/RealCLanger) + +## Safe Deserialization + +For information about safe deserialization, please see [Safe Deserialization](https://commons.apache.org/io/description.html#Safe_Deserialization). diff --git a/src/site/xdoc/security.xml b/src/site/xdoc/security.xml deleted file mode 100644 index 5244451f..00000000 --- a/src/site/xdoc/security.xml +++ /dev/null @@ -1,77 +0,0 @@ -<?xml version="1.0"?> -<!-- Licensed to the Apache Software Foundation (ASF) under one or more contributor license agreements. See the NOTICE file distributed with this work for additional - information regarding copyright ownership. The ASF licenses this file to you under the Apache License, Version 2.0 (the "License"); you may not use this file except - in compliance with the License. You may obtain a copy of the License at https://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to - in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See - the License for the specific language governing permissions and limitations under the License. --> -<document xmlns="http://maven.apache.org/XDOC/2.0"; xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"; - xsi:schemaLocation="http://maven.apache.org/XDOC/2.0 https://maven.apache.org/xsd/xdoc-2.0.xsd";> - <properties> - <title>Apache Commons Security Reports</title> - <author email="[email protected]">Apache Commons Team</author> - </properties> - <body> - <section name="About Security"> - <p> - For information about reporting or asking questions about security, please see - <a href="https://commons.apache.org/security.html";>Apache Commons Security</a> - . - </p> - <p>This page lists all security vulnerabilities fixed in released versions of this component. - </p> - <p>Please note that binary patches are never provided. If you need to apply a source code patch, use the building instructions for the component version - that you are using. - </p> - <p> - If you need help on building this component or other help on following the instructions to mitigate the known vulnerabilities listed here, please send - your questions to the public - <a href="mail-lists.html">user mailing list</a> - . - </p> - <p>If you have encountered an unlisted security vulnerability or other unexpected behavior that has security impact, or if the descriptions here are - incomplete, please report them privately to the Apache Security Team. Thank you. - </p> - </section> - <section name="Security Model"> - <p>The <a href="https://commons.apache.org/security.html#Security_Model";>Apache Commons security model</a> specifies - that it is unsafe to pass possibly malicious input to Commons libraries - unless otherwise specified. - For Commons BCEL, processing untrusted class data is supported to the extent that - this should never allow the supplier of the data to trigger arbitrary code execution, - filesystem or network access. It may still trigger other crashes, such as for example <code>StackOverflowError</code> or <code>OutOfMemoryError</code>: - if your code uses BCEL to process untrusted input - then it is up to you to compensate for that as necessary. - Loading or executing the generated classes is unsafe and may cause unexpected behavior, - including execute arbitrary code execution. - </p> - </section> - <section name="Security Vulnerabilities"> - <subsection name="CVE-2022-42920"> - <ul> - <li>CVE-2022-42920: Apache Commons BCEL prior to 6.6.0 allows producing arbitrary bytecode via out-of-bounds writing.</li> - <li>Severity: Critical</li> - <li>CWE-ID: CWE-787</li> - <li>Vendor: The Apache Software Foundation</li> - <li>Versions Affected: Apache Commons BCEL before 6.6.0.</li> - <li>Description: Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an - out-of-bounds writing issue, these APIs can be used to produce arbitrary bytecode. This could be abused in applications that pass - attacker-controllable data to those APIs, giving the attacker more control over the resulting bytecode than otherwise expected. Update to Apache - Commons BCEL 6.6.0. - </li> - <li>Mitigation: Users are recommended to upgrade to version 6.6.0 or later, which fixes the issue.</li> - <li>Credit: Reported by Felix Wilhelm (Google)</li> - <li>Credit: GitHub pull request to Apache Commons BCEL #147 by Richard Atkins (https://github.com/rjatkins)</li> - <li>Credit: PR - derived from OpenJDK (https://github.com/openjdk/jdk11u/) commit 13bf52c8d876528a43be7cb77a1f452d29a21492 by Aleksei Voitylov and - RealCLanger (Christoph Langer https://github.com/RealCLanger) - </li> - </ul> - </subsection> - </section> - <section name="Safe Deserialization"> - <p> - For information about safe deserialization, please see <a href="https://commons.apache.org/io/description.html#Safe_Deserialization";>Safe Deserialization</a>. - </p> - </section> - </body> -</document>
