CVE-2014-0114

TuxCare rebuilt commons-beanutils:commons-beanutils to address 1 CVE. Fixed in 1.8.0-tuxcare.1.

TuxCare rebuilt org.springframework.graphql:spring-graphql to address 6 CVEs. Fixed in 1.3.5-tuxcare.1.

TuxCare rebuilt commons-beanutils:commons-beanutils to address 1 CVE. Fixed in 1.9.2-tuxcare.1.

TuxCare rebuilt commons-configuration:commons-configuration to address 2 CVEs. Fixed in 1.6-tuxcare.1.

TuxCare rebuilt commons-beanutils:commons-beanutils to address 3 CVEs. Fixed in 1.9.3-tuxcare.1.

TuxCare rebuilt commons-beanutils:commons-beanutils to address 1 CVE. Fixed in 1.9.0-tuxcare.2.

TuxCare rebuilt commons-beanutils:commons-beanutils to address 1 CVE. Fixed in 1.8.2-tuxcare.1.

Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.

Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.

Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.

Updated struts packages fix security vulnerability:

It was found that the Struts 1 ActionForm object allowed access to the 'class' parameter, which is directly mapped to the getClass() method. A remote attacker could use this flaw to manipulate the ClassLoader used by an application server running Struts 1. This could lead to remote code execution under certain conditions (CVE-2014-0114).

These are all security issues fixed in the apache-commons-beanutils-1.9.4-3.7 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the apache-commons-validator-1.10.1-1.1 package on the GA media of openSUSE Tumbleweed.

Root has patched CVE-2014-0114 in the commons-beanutils:commons-beanutils package for Root:Maven. Multiple fixed versions available.

This collective update for SUSE Manager Server 2.1 provides the following new features:

* Connect SUSE Manager to the SUSE Customer Center.
* Manage SLE12 systems.
* ISS: export/import information about cloned channels to support
  Service Pack migration on ISS slaves. (FATE#317789)
* New API calls: system.scheduleSPMigration(),
  system.scheduleDistUpgrade(). (FATE#314785, FATE#314340)

Additionally, several issues have been fixed:

auditlog-keeper:

* Fix value too long for type character varying(2048). (bnc#872351)
* Fix init.d script restart. (bsc#872029)

cobbler:

* Require syslinux-x86_64 on s390x. (bsc#884051)
* Fix fetching of profiles for auto-installation. (bsc#880936)
* Fix port guessing in koan. (bsc#855389)
* Add 'copy-default' option to grubby-compat. (bsc#855389)
* Handle elilo in SUSE. (bsc#855389)
* Fix wrong option 'text' in SUSE environment. (bsc#901058)
* Fix re-installation on SLE with static network configuration.
  (bsc#883487)
* Add RHEL 7 as a valid operating system version.

oracle-config:

* No need to pre-require Apache as its user and group are available in
  the base system.

osad:

* Enable and install osad during first installation. (bsc#901958)

pxe-default-image:

* Add bind-utils (dig) to packagelist. (bsc#889739)
* Wait for gateway to become available before register. (bsc#895001)

rhnlib:

* Ensure bytes strings are sent to pyOpenSSL. (bnc#880388)

rhnpush:

* Add default path structure to proxy lookaside that avoids collisions.

sm-ncc-sync-data:

* Add SUSE Cloud 4 channels. (bnc#883057)
* Add channels for SUSE Manager Server 2.1 s390x.
* Fix parent label of the LTSS channel for SLMS.
* Add ATI and nVidia channels for SLED11-SP3. (bsc#901108)
* Add support for RES7 in SUSE Manager. (bsc#897723, bsc#893608)

smdba:

* Fix 'system check breaks backup and other configuration'.
* Implement rotating PostgreSQL backup. (bsc#896244)
* Space reclamation caused ORA-00942: table or view does not exist.
  (bsc#906850)
* Archival of PosgreSQL transaction log does not recover in case of no
  space left on device. (bsc#915140)

spacecmd:

* Fix listupgrades. (bsc#892707)
* Make print_result a static method of SpacewalkShell. (bsc#889605)
* Call listAutoinstallableChannels() for listing distributions.
  (bsc#887879)
* Fix spacecmd schedule listing. (bsc#902494)
* Fix call of setCustomOptions() during kickstart_importjson.
  (bsc#879904)
* Fix configchannel export: do not create 'contents' key for
  directories. (bsc#908849)

spacewalk-backend:

* Insert update tag at the correct place for SLE12. (bsc#907677)
* Trigger generation of metadata if the repo contains no packages.
  (bsc#870159)
* Convert mtime to localtime to prevent invalid times because of DST.
  (bsc#914437)
* Do not exit with error if a vendor channel has no URL associated.
  (bsc#914260)
* Convert empty string to null for DMI values. (bsc#911272)

spacewalk-branding:

* CVE patches adapted for colour blind users. (bnc#872298)
* Underline in icons is removed. (bnc#880001)
* Fix link to macro documentation. (bsc#895961)
* Fix branding in error message. (bsc#902503)

spacewalk-certs-tools:

* Fix removal of existing host key entries. (bsc#886391)
* Remove duplicates from authorized_keys2 as well. (bsc#885889)
* Do not allow registering a SUSE Manager server against itself.
  (bsc#841731)

spacewalk-client-tools:

* Allow unicode characters in proxy username and password.
* Send correct hostname. (bsc#887538)

spacewalk-config:

* Add recommended Apache settings from the Security Team.

spacewalk-java:

* Fix human dates now() staying unmodified. (bnc#880081)
* Allow for null evr and archs on event history detail. (bnc#880327)
* Disable form autocompletion in some places.…

Apache Struts was updated to fix a security issue:

* CVE-2014-0114: The ActionForm object in Apache Struts 1.x through
  1.3.10 allows remote attackers to 'manipulate' the ClassLoader and
  execute arbitrary code via the class parameter, which is passed to
  the getClass method.

Security Issue reference:

* CVE-2014-0114
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0114>

This update for apache-commons-beanutils fixes the following issues:

Update to 1.11.0:

• Fixed Bugs:

  • BeanComparator.compare(T, T) now throws IllegalArgumentException instead of RuntimeException to wrap all cases of ReflectiveOperationException.
  • MappedMethodReference.get() now throws IllegalStateException instead of RuntimeException to wrap cases of NoSuchMethodException.
  • ResultSetIterator.get(String) now throws IllegalArgumentException instead of RuntimeException to wrap cases of SQLException.
  • ResultSetIterator.hasNext() now throws IllegalStateException instead of RuntimeException to wrap cases of SQLException.
  • ResultSetIterator.next() now throws IllegalStateException instead of RuntimeException to wrap cases of SQLException.
  • ResultSetIterator.set(String, Object) now throws IllegalArgumentException instead of RuntimeException to wrap cases of SQLException.
  • ResultSetIterator.set(String, String, Object) now throws IllegalArgumentException instead of RuntimeException to wrap cases of SQLException.

• Changes:

  • Add org.apache.commons.beanutils .SuppressPropertiesBeanIntrospector.SUPPRESS_DECLARING_CLASS. Fixes bsc#1243793, CVE-2025-48734
  • Bump org.apache.commons:commons-parent from 81 to 84.
  • Bump commons-logging:commons-logging from 1.3.4 to 1.3.5.

Update to 1.10.1:

• Fixed Bugs:

  • BEANUTILS-541: FluentPropertyBeanIntrospector concurrency issue (backport to 1.X) #325.
  • Javadoc is missing its Overview page.
  • Remove -nouses directive from maven-bundle-plugin. OSGi package imports now state 'uses' definitions for package imports, this doesn't affect JPMS (from org.apache.commons:commons-parent:80).
  • Deprecate BeanUtils.BeanUtils().
  • Deprecate ConstructorUtils.ConstructorUtils().
  • Deprecate LocaleBeanUtils.LocaleBeanUtils().
  • Deprecate LocaleConvertUtils.LocaleConvertUtils().
  • Deprecate ConvertUtils.ConvertUtils().
  • Deprecate MethodUtils.MethodUtils().
  • Deprecate PropertyUtils.PropertyUtils().

• Changes:

  • Bump org.apache.commons:commons-parent from 78 to 81.

Includes changes from 1.10.0:

• Fixed Bugs:

  • BEANUTILS-541: FluentPropertyBeanIntrospector caches corrupted writeMethod (1.x backport) #69.
  • Replace internal use of Locale.ENGLISH with Locale.ROOT.
  • Replace Maven CLIRR plugin with JApiCmp.
  • Port to Java 1.4 Throwable APIs (!).
  • Fix Javadoc generation on Java 8, 17, and 21.
  • AbstractArrayConverter.parseElements(String) now returns a List<String> instead of a raw List.

• Changes:

  • Bump org.apache.commons:commons-parent from 47 to 78.
  • Bump Java requirement from Java 6 to 8.
  • Bump junit:junit from 4.12 to 4.13.2.
  • Bump JUnit from 4.x to 5.x 'vintage'.
  • Bump commons-logging:commons-logging from 1.2 to 1.3.4.
  • Deprecate BeanUtilsBean.initCause(Throwable, Throwable) for removal, use Throwable.initCause(Throwable).
  • Deprecate BeanUtils.initCause(Throwable, Throwable) for removal, use Throwable.initCause(Throwable).

Update to 1.9.4:

• BEANUTILS-520: BeanUtils mitigate CVE-2014-0114

Updated to 1.9.3:

• This is a bug fix release, which also improves the tests for building on Java 8.

• Note that Java 8 and later no longer support indexed bean properties on java.util.List, only on arrays like String[]. (BEANUTILS-492). This affects PropertyUtils.getPropertyType() and PropertyUtils.getPropertyDescriptor(); their javadoc have therefore been updated to reflect this change in the JDK.

• Changes in this version include:

  • Fixed Bugs:

    • BEANUTILS-477: Changed log level in FluentPropertyBeanIntrospector
    • BEANUTILS-492: Fixed exception when setting indexed properties on DynaBeans.
    • BEANUTILS-470: Precision lost when converting BigDecimal. *…

Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.

It was discovered that Apache Commons BeanUtils improperly handled certain input. An attacker could possibly use this vulnerability to cause a crash or execute arbitrary code.

USN-8322-1 fixed a vulnerability in Apache Commons BeanUtils. It was discovered that for Ubuntu 18.04 LTS, during the update preparation phase, a previous fix for CVE-2014-0114 and CVE-2019-10086 was incorrectly dropped. This update reintroduces the fix for CVE-2014-0114 and CVE-2019-10086.

We apologize for the inconvenience.

Original advisory details:

It was discovered that Apache Commons BeanUtils incorrectly allowed access to the declaredClass property of Java enum objects when handling externally supplied property paths. An attacker could possibly use this issue to execute arbitrary code.