CVE-2020-13936

An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache Velocity Engine versions up to 2.2.

Velocity is a Java-based template engine. It permits anyone to use the simple yet powerful template language to reference objects defined in Java code.

Security Fix(es):

An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache Velocity Engine versions up to 2.2.(CVE-2020-13936)

An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache Velocity Engine versions up to 2.2.

TuxCare rebuilt org.apache.velocity:velocity to address 1 CVE. Fixed in 1.7.tuxcare.1.

An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache Velocity Engine versions up to 2.2 (CVE-2020-13936).

This update for velocity fixes the following issues:

• CVE-2020-13936: Fixed an arbitrary code execution when attacker is able to modify templates (bsc#1183360).

This update was imported from the SUSE:SLE-15-SP2:Update update project.

These are all security issues fixed in the velocity-1.7-9.3 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the velocity-custom-parser-example-2.2-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the snakeyaml-1.31-1.1 package on the GA media of openSUSE Tumbleweed.

Root has patched CVE-2020-13936 in the io.root.org.apache.velocity:velocity package for Root:Maven. Multiple fixed versions available.

This update for velocity fixes the following issues:

• CVE-2020-13936: Fixed an arbitrary code execution when attacker is able to modify templates (bsc#1183360).

This update for snakeyaml fixes the following issues:

• CVE-2022-38750: Fixed uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject (bsc#1203158).
• CVE-2022-38749: Fixed StackOverflowError for many open unmatched brackets (bsc#1203149).
• CVE-2022-38752: Fixed uncaught exception in java.base/java.util.ArrayList.hashCode (bsc#1203154).
• CVE-2022-38751: Fixed unrestricted data matched with Regular Expressions (bsc#1203153).
• CVE-2022-25857: Fixed denial of service vulnerability due missing to nested depth limitation for collections (bsc#1202932).

This update for snakeyaml fixes the following issues:

snakeyaml was upgraded to version 1.31:

• CVE-2022-25857: Fixed DoS due missing to nested depth limitation for collections (bsc#1202932).
• CVE-2022-38749: Fixed DoS due to stack overflow in parser (bsc#1202932).
• CVE-2022-38751: Fixed DoS due to parsing of untrusted yaml files (bsc#1203153).
• CVE-2022-38752: Fixed DoS due to stack overflow in parser (bsc#1203154).
• CVE-2022-38750: Fixed DoS due to parsing of untrusted yaml files (bsc#1203158).
• CVE-2020-13936: Fixed arbitrary code execution when attacker is able to modify templates (bsc#1183360).

This update for Maven fixes the following issues:

maven-dependency-analyzer was updated from version 1.13.2 to 1.15.1:

• Key changes across versions:
  • Bug fixes and improved support of dynamic types
  • Dependency upgrades (ASM, Maven core, and notably the removal of commons-io)
  • Improved error handling by logging instead of failing
  • Improved dependency usage tracking

maven-dependency-plugin was updated from version 3.6.0 to 3.8.1:

• Key changes across versions:
  • Dependency upgrades on maven-dependency-analyzer and Doxia
  • Deprecated dependency:sources in favor of dependency:resolve-sources
  • Documentation improvements
  • New dependency analysis goal to check for invalid exclusions
  • New JSON output option for dependency:tree
  • Performance improvements
  • Several bug fixes addressing:
    • The handling of silent parameters
    • The display of the optional flag in the tree
    • The clarity of some error messages

maven-doxia-sitetools was updated from version 1.11.1 to 2.0.0:

• Key changes across versions:
  • New features:
    • Passing the input filename to the parser
    • Adding a timezone field to the site descriptor
    • Configuring parsers per markup
  • Improvements:
    • Clarifying site descriptor properties
    • Requiring a skin if a site descriptor (site.xml) has been provided
    • Optimization of resource handling
    • Overhauled locale support
    • Refinined menu item display
    • Use of Maven Resolver for artifact resolution
    • Enhanced Velocity context population
    • Automating anchor creation
  • Internal changes:
    • Migration from Plexus to Sisu
    • Upgraded to Java 8
    • Removal of deprecated components and features (such as Maven 1.x support, Google-related properties)
    • Simplified the site model
    • Improved the DocumentRenderer interface/DocumentRenderingContext class API
  • Several bug fixes addressing:
    • The Plexus to Sisu migration
    • Decoration model injection
    • Anchor creation
    • XML character escaping
    • Handling of 0-byte site descriptors

maven-doxia was updated from version 1.12.0 to 2.0.0:

• Key changes across versions:
  • Improved HTML5 Support:
    • Obsolete attributes and elements were removed
    • CSS styles are now used for styling
    • XHTML5 is now the default HTML implementation, and XHTML(4) is deprecated
  • Improved Markdown Support:
    • A new Markdown sink allows converting content to Markdown.
    • Support for various Markdown features like blockquotes, footnotes, and metadata has been added
  • General Improvements:
    • Dependencies were updated
    • Doxia was upgraded to Java 8
    • Logging and Doxia ID generation were streamlined
    • Migration from Plexus to Sisu
    • Removed deprecated modules and code
  • Several bug fixes addressing:
    • HTML5 incorrect output such as tables, styling and missing or improperly handled attributes
    • Markdown formatting issues
    • Issues with plexus migration
    • Incorrect generation of unique IDs
    • Incorrect anchor generation for document titles
    • Ignored element classes

maven-invoker-plugin was updated from version 3.2.2 to 3.8.1:

• Key changes across versions:
  • Commons-lang3 was removed
  • Custom Maven executables, external POM files, and more CLI options are now supported
  • Deprecated code was cleaned up
  • Doxia was updated, improving HTML generation and adding Markdown support
  • Groovy was updated, adding support for JDK 19
  • Improved Reporting and Time Handling
  • Enhanced syntax support for invoker properties and Maven options
  • Java 8 is now the minimum supported version
  • Maven 3.6.3 is now the minimum supported version
  • Several dependencies were updated or removed
  • Snapshot update behavior can be controlled
  • Several bug fixes addressing issues with:
    • Dependency resolution
    • Environment variables
    • File handling
    • Report generation
    • Threading

maven-invoker was updated from version…

Alvaro Munoz discovered that Velocity Engine incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to execute arbitrary code.