{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Apache Commons ist ein Apache-Projekt, das alle Aspekte der wiederverwendbaren Java-Komponenten behandelt.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Apache Commons Text ausnutzen, um beliebigen Programmcode auszuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- MacOS X\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2022-1758 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2022/wid-sec-w-2022-1758.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2022-1758 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1758"
      },
      {
        "category": "external",
        "summary": "Github Security Advisory GHSL-2022-018 vom 2022-10-17",
        "url": "https://securitylab.github.com/advisories/GHSL-2022-018_Apache_Commons_Text/"
      },
      {
        "category": "external",
        "summary": "Github Security Advisory GHSA-599f-7c49-w659 vom 2022-10-17",
        "url": "https://github.com/advisories/GHSA-599f-7c49-w659"
      },
      {
        "category": "external",
        "summary": "Red Hat Bugzilla Bug ID 2135435 vom 2022-10-17",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135435"
      },
      {
        "category": "external",
        "summary": "PoC vom 2022-10-17",
        "url": "https://github.com/SeanWrightSec/CVE-2022-42889-PoC"
      },
      {
        "category": "external",
        "summary": "Unify Security Advisory Report OBSO-2210-01 vom 2022-10-26",
        "url": "https://networks.unify.com/security/advisories/OBSO-2210-01.pdf"
      },
      {
        "category": "external",
        "summary": "Enhancements and bug fixes for Desktop Central",
        "url": "http://www.manageengine.com/products/desktop-central/hotfix-readme1.html"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 6833874 vom 2022-11-03",
        "url": "https://www.ibm.com/blogs/psirt/security-bulletin-ibm-spss-modeler-is-vulnerable-to-apache-commons-text-cve-2022-42889/"
      },
      {
        "category": "external",
        "summary": "Citrix Security Advisory CTX474006 vom 2022-11-09",
        "url": "https://support.citrix.com/article/CTX474006/citrix-security-advisory-for-cve202242889"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:8652 vom 2022-11-28",
        "url": "https://access.redhat.com/errata/RHSA-2022:8652"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:8876 vom 2022-12-07",
        "url": "https://access.redhat.com/errata/RHSA-2022:8876"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:8902 vom 2022-12-08",
        "url": "https://access.redhat.com/errata/RHSA-2022:8902"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 6841279 vom 2022-12-09",
        "url": "https://www.ibm.com/support/pages/node/6841279"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:9023 vom 2022-12-14",
        "url": "https://access.redhat.com/errata/RHSA-2022:9023"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin",
        "url": "https://www.ibm.com/support/pages/node/6848317"
      },
      {
        "category": "external",
        "summary": "Gentoo Linux Security Advisory GLSA-202301-05 vom 2023-01-11",
        "url": "http://security.gentoo.org/glsa/202301-05"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:0261 vom 2023-01-18",
        "url": "https://access.redhat.com/errata/RHSA-2023:0261"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:1006 vom 2023-03-09",
        "url": "https://access.redhat.com/errata/RHSA-2023:1006"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7095693 vom 2023-12-12",
        "url": "https://www.ibm.com/support/pages/node/7095693"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:1524 vom 2023-04-06",
        "url": "https://access.redhat.com/errata/RHSA-2023:1524"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:1655 vom 2023-04-12",
        "url": "https://access.redhat.com/errata/RHSA-2023:1655"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 6985689 vom 2023-04-24",
        "url": "https://www.ibm.com/support/pages/node/6985689"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:1866 vom 2023-04-26",
        "url": "https://access.redhat.com/errata/RHSA-2023:1866"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:3299 vom 2023-05-24",
        "url": "https://access.redhat.com/errata/RHSA-2023:3299"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7008449 vom 2023-06-29",
        "url": "https://www.ibm.com/support/pages/node/7008449"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:2135 vom 2024-02-19",
        "url": "https://access.redhat.com/errata/RHSA-2023:2135"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:0775 vom 2024-02-12",
        "url": "https://access.redhat.com/errata/RHSA-2024:0775"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:0776 vom 2024-02-12",
        "url": "https://access.redhat.com/errata/RHSA-2024:0776"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:0777 vom 2024-02-12",
        "url": "https://access.redhat.com/errata/RHSA-2024:0777"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:0778 vom 2024-02-12",
        "url": "https://access.redhat.com/errata/RHSA-2024:0778"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:3527 vom 2024-05-30",
        "url": "https://access.redhat.com/errata/RHSA-2024:3527"
      }
    ],
    "source_lang": "en-US",
    "title": "Apache Commons Text: Schwachstelle erm\u00f6glicht Codeausf\u00fchrung",
    "tracking": {
      "current_release_date": "2024-05-30T22:00:00.000+00:00",
      "generator": {
        "date": "2024-05-31T09:08:24.805+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.0"
        }
      },
      "id": "WID-SEC-W-2022-1758",
      "initial_release_date": "2022-10-17T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2022-10-17T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2022-10-19T22:00:00.000+00:00",
          "number": "2",
          "summary": "Schwachstelle wird auch \"Log4Text\" genannt"
        },
        {
          "date": "2022-10-26T22:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates von Unify aufgenommen"
        },
        {
          "date": "2022-11-02T23:00:00.000+00:00",
          "number": "4",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2022-11-08T23:00:00.000+00:00",
          "number": "5",
          "summary": "Neue Updates von Citrix aufgenommen"
        },
        {
          "date": "2022-11-22T23:00:00.000+00:00",
          "number": "6",
          "summary": "Referenz(en) aufgenommen:"
        },
        {
          "date": "2022-11-28T23:00:00.000+00:00",
          "number": "7",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2022-12-07T23:00:00.000+00:00",
          "number": "8",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2022-12-08T23:00:00.000+00:00",
          "number": "9",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2022-12-14T23:00:00.000+00:00",
          "number": "10",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2022-12-20T23:00:00.000+00:00",
          "number": "11",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2023-01-10T23:00:00.000+00:00",
          "number": "12",
          "summary": "Neue Updates von Gentoo aufgenommen"
        },
        {
          "date": "2023-01-18T23:00:00.000+00:00",
          "number": "13",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2023-03-08T23:00:00.000+00:00",
          "number": "14",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2023-03-16T23:00:00.000+00:00",
          "number": "15",
          "summary": "Korrektur: Citrix Produkte nicht betroffen (CTX474006)"
        },
        {
          "date": "2023-04-10T22:00:00.000+00:00",
          "number": "16",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2023-04-12T22:00:00.000+00:00",
          "number": "17",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2023-04-24T22:00:00.000+00:00",
          "number": "18",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2023-04-25T22:00:00.000+00:00",
          "number": "19",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2023-05-24T22:00:00.000+00:00",
          "number": "20",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2023-06-29T22:00:00.000+00:00",
          "number": "21",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2023-12-12T23:00:00.000+00:00",
          "number": "22",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2024-02-11T23:00:00.000+00:00",
          "number": "23",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2024-02-19T23:00:00.000+00:00",
          "number": "24",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2024-05-30T22:00:00.000+00:00",
          "number": "25",
          "summary": "Neue Updates von Red Hat aufgenommen"
        }
      ],
      "status": "final",
      "version": "25"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "Text \u003c1.10.0",
                "product": {
                  "name": "Apache Commons Text \u003c1.10.0",
                  "product_id": "T024957",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:apache:commons:1.10.0::text"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Commons"
          }
        ],
        "category": "vendor",
        "name": "Apache"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Gentoo Linux",
            "product": {
              "name": "Gentoo Linux",
              "product_id": "T012167",
              "product_identification_helper": {
                "cpe": "cpe:/o:gentoo:linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Gentoo"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "IBM DB2",
            "product": {
              "name": "IBM DB2",
              "product_id": "5104",
              "product_identification_helper": {
                "cpe": "cpe:/a:ibm:db2:-"
              }
            }
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "11.7",
                "product": {
                  "name": "IBM InfoSphere Information Server 11.7",
                  "product_id": "444803",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:infosphere_information_server:11.7"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "InfoSphere Information Server"
          },
          {
            "category": "product_name",
            "name": "IBM SPSS",
            "product": {
              "name": "IBM SPSS",
              "product_id": "T013570",
              "product_identification_helper": {
                "cpe": "cpe:/a:ibm:spss:-"
              }
            }
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "11.4",
                "product": {
                  "name": "IBM Security Guardium 11.4",
                  "product_id": "1076561",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:security_guardium:11.4"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "11.5",
                "product": {
                  "name": "IBM Security Guardium 11.5",
                  "product_id": "1411051",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:security_guardium:11.5"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Security Guardium"
          }
        ],
        "category": "vendor",
        "name": "IBM"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Red Hat Enterprise Linux",
            "product": {
              "name": "Red Hat Enterprise Linux",
              "product_id": "67646",
              "product_identification_helper": {
                "cpe": "cpe:/o:redhat:enterprise_linux:-"
              }
            }
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "Container Platform 4.9",
                "product": {
                  "name": "Red Hat OpenShift Container Platform 4.9",
                  "product_id": "T020655",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift:container_platform_4.9.0"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "container platform 4.10",
                "product": {
                  "name": "Red Hat OpenShift container platform 4.10",
                  "product_id": "T027233",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift:container_platform_4.10"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "OpenShift"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Unify OpenScape Contact Center",
            "product": {
              "name": "Unify OpenScape Contact Center",
              "product_id": "T008876",
              "product_identification_helper": {
                "cpe": "cpe:/a:unify:openscape_contact_center:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Unify OpenScape UC Application",
            "product": {
              "name": "Unify OpenScape UC Application",
              "product_id": "T015712",
              "product_identification_helper": {
                "cpe": "cpe:/a:unify:openscape_uc_application:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Unify"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c10.1.2228.10",
                "product": {
                  "name": "Zoho ManageEngine Desktop Central \u003c10.1.2228.10",
                  "product_id": "T025133",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:zohocorp:manageengine_desktop_central:10.1.2228.10"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "ManageEngine Desktop Central"
          }
        ],
        "category": "vendor",
        "name": "Zoho"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-42889",
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle in Apache Commons Text in der Klasse \"StringSubstitutor\". Ursache ist eine unsichere dynamische Interpolation von Variablen. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um beliebigen Programmcode auszuf\u00fchren."
        }
      ],
      "product_status": {
        "known_affected": [
          "T008876",
          "67646",
          "444803",
          "T015712",
          "T020655",
          "5104",
          "1076561",
          "T012167",
          "T013570",
          "T025133",
          "T027233",
          "1411051"
        ]
      },
      "release_date": "2022-10-17T22:00:00Z",
      "title": "CVE-2022-42889"
    }
  ]
}