{"id":"CVE-2025-53192","aliases":["DEBIAN-CVE-2025-53192","EUVD-2025-28495","GHSA-5vgh-76mj-8hcq","SUSE-SU-2025:03285-1","SUSE-SU-2025:3825-1","SUSE-SU-2025:3827-1","SUSE-SU-2025:3839-1","UBUNTU-CVE-2025-53192","openSUSE-SU-2025:15567-1","openSUSE-SU-2025:15568-1"],"status":"published","title":"Apache Commons OGNL: Expression Injection leading to RCE","description":"** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Expression/Command Delimiters vulnerability in Apache Commons OGNL.\n\nThis issue affects Apache Commons OGNL: all versions.\n\n\n\nWhen using the API Ognl.getValue​, the OGNL engine parses and evaluates the provided expression with powerful capabilities, including accessing and invoking related methods,\n etc. Although OgnlRuntime attempts to restrict certain dangerous classes and methods (such as java.lang.Runtime) through a blocklist, these restrictions are not comprehensive. \nAttackers may be able to bypass the restrictions by leveraging class objects that are not covered by the blocklist and potentially achieve arbitrary code execution.\n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\n\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00623,"percentile":0.50148,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-146"],"published":"2025-08-18T20:09:31Z","modified":"2026-10-17T12:57:07Z","fixes":[{"ecosystem":"openSUSE:Leap 15.6","package":"mybatis","fixed_in":["3.5.19-150200.5.9.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"ognl","fixed_in":["3.4.7-150200.5.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 5.0","package":"suse-manager-5.0-aarch64-proxy-httpd-image","fixed_in":["5.0.5.1-7.24.21"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 5.0","package":"suse-manager-5.0-aarch64-proxy-salt-broker-image","fixed_in":["5.0.5.1-7.26.21"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 5.0","package":"suse-manager-5.0-aarch64-proxy-squid-image","fixed_in":["5.0.5.1-7.24.7"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 5.0","package":"suse-manager-5.0-aarch64-proxy-ssh-image","fixed_in":["5.0.5.1-7.24.7"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 5.0","package":"suse-manager-5.0-aarch64-proxy-tftpd-image","fixed_in":["5.0.5.1-7.24.7"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 5.0","package":"suse-manager-5.0-ppc64le-proxy-httpd-image","fixed_in":["5.0.5.1-7.24.21"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 5.0","package":"suse-manager-5.0-ppc64le-proxy-salt-broker-image","fixed_in":["5.0.5.1-7.26.21"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 5.0","package":"suse-manager-5.0-ppc64le-proxy-squid-image","fixed_in":["5.0.5.1-7.24.7"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 5.0","package":"suse-manager-5.0-ppc64le-proxy-ssh-image","fixed_in":["5.0.5.1-7.24.7"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 5.0","package":"suse-manager-5.0-ppc64le-proxy-tftpd-image","fixed_in":["5.0.5.1-7.24.7"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 5.0","package":"suse-manager-5.0-s390x-proxy-httpd-image","fixed_in":["5.0.5.1-7.24.21"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 5.0","package":"suse-manager-5.0-s390x-proxy-salt-broker-image","fixed_in":["5.0.5.1-7.26.21"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 5.0","package":"suse-manager-5.0-s390x-proxy-squid-image","fixed_in":["5.0.5.1-7.24.7"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 5.0","package":"suse-manager-5.0-s390x-proxy-ssh-image","fixed_in":["5.0.5.1-7.24.7"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 5.0","package":"suse-manager-5.0-s390x-proxy-tftpd-image","fixed_in":["5.0.5.1-7.24.7"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 5.0","package":"suse-manager-5.0-x86_64-proxy-httpd-image","fixed_in":["5.0.5.1-7.24.21"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 5.0","package":"suse-manager-5.0-x86_64-proxy-salt-broker-image","fixed_in":["5.0.5.1-7.26.21"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 5.0","package":"suse-manager-5.0-x86_64-proxy-squid-image","fixed_in":["5.0.5.1-7.24.7"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 5.0","package":"suse-manager-5.0-x86_64-proxy-ssh-image","fixed_in":["5.0.5.1-7.24.7"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 5.0","package":"suse-manager-5.0-x86_64-proxy-tftpd-image","fixed_in":["5.0.5.1-7.24.7"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Retail Branch Server Extension 5.0","package":"suse-manager-5.0-aarch64-proxy-httpd-image","fixed_in":["5.0.5.1-7.24.21"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Retail Branch Server Extension 5.0","package":"suse-manager-5.0-aarch64-proxy-salt-broker-image","fixed_in":["5.0.5.1-7.26.21"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Retail Branch Server Extension 5.0","package":"suse-manager-5.0-aarch64-proxy-squid-image","fixed_in":["5.0.5.1-7.24.7"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Retail Branch Server Extension 5.0","package":"suse-manager-5.0-aarch64-proxy-ssh-image","fixed_in":["5.0.5.1-7.24.7"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Retail Branch Server Extension 5.0","package":"suse-manager-5.0-aarch64-proxy-tftpd-image","fixed_in":["5.0.5.1-7.24.7"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Retail Branch Server Extension 5.0","package":"suse-manager-5.0-ppc64le-proxy-httpd-image","fixed_in":["5.0.5.1-7.24.21"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Retail Branch Server Extension 5.0","package":"suse-manager-5.0-ppc64le-proxy-salt-broker-image","fixed_in":["5.0.5.1-7.26.21"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Retail Branch Server Extension 5.0","package":"suse-manager-5.0-ppc64le-proxy-squid-image","fixed_in":["5.0.5.1-7.24.7"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Retail Branch Server Extension 5.0","package":"suse-manager-5.0-ppc64le-proxy-ssh-image","fixed_in":["5.0.5.1-7.24.7"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Retail Branch Server Extension 5.0","package":"suse-manager-5.0-ppc64le-proxy-tftpd-image","fixed_in":["5.0.5.1-7.24.7"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Retail Branch Server Extension 5.0","package":"suse-manager-5.0-s390x-proxy-httpd-image","fixed_in":["5.0.5.1-7.24.21"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Retail Branch Server Extension 5.0","package":"suse-manager-5.0-s390x-proxy-salt-broker-image","fixed_in":["5.0.5.1-7.26.21"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Retail Branch Server Extension 5.0","package":"suse-manager-5.0-s390x-proxy-squid-image","fixed_in":["5.0.5.1-7.24.7"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Retail Branch Server Extension 5.0","package":"suse-manager-5.0-s390x-proxy-ssh-image","fixed_in":["5.0.5.1-7.24.7"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Retail Branch Server Extension 5.0","package":"suse-manager-5.0-s390x-proxy-tftpd-image","fixed_in":["5.0.5.1-7.24.7"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Retail Branch Server Extension 5.0","package":"suse-manager-5.0-x86_64-proxy-httpd-image","fixed_in":["5.0.5.1-7.24.21"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Retail Branch Server Extension 5.0","package":"suse-manager-5.0-x86_64-proxy-salt-broker-image","fixed_in":["5.0.5.1-7.26.21"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Retail Branch Server Extension 5.0","package":"suse-manager-5.0-x86_64-proxy-squid-image","fixed_in":["5.0.5.1-7.24.7"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Retail Branch Server Extension 5.0","package":"suse-manager-5.0-x86_64-proxy-ssh-image","fixed_in":["5.0.5.1-7.24.7"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Retail Branch Server Extension 5.0","package":"suse-manager-5.0-x86_64-proxy-tftpd-image","fixed_in":["5.0.5.1-7.24.7"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 5.0","package":"suse-manager-5.0-aarch64-server-attestation-image","fixed_in":["5.0.5.1-6.28.7"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 5.0","package":"suse-manager-5.0-aarch64-server-hub-xmlrpc-api-image","fixed_in":["5.0.5.1-6.24.9"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 5.0","package":"suse-manager-5.0-aarch64-server-image","fixed_in":["5.0.5.1-7.31.17"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 5.0","package":"suse-manager-5.0-aarch64-server-migration-14-16-image","fixed_in":["5.0.5.1-7.24.12"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 5.0","package":"suse-manager-5.0-ppc64le-server-attestation-image","fixed_in":["5.0.5.1-6.28.7"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 5.0","package":"suse-manager-5.0-ppc64le-server-hub-xmlrpc-api-image","fixed_in":["5.0.5.1-6.24.9"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 5.0","package":"suse-manager-5.0-ppc64le-server-image","fixed_in":["5.0.5.1-7.31.17"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 5.0","package":"suse-manager-5.0-ppc64le-server-migration-14-16-image","fixed_in":["5.0.5.1-7.24.12"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 5.0","package":"suse-manager-5.0-s390x-server-attestation-image","fixed_in":["5.0.5.1-6.28.7"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 5.0","package":"suse-manager-5.0-s390x-server-hub-xmlrpc-api-image","fixed_in":["5.0.5.1-6.24.9"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 5.0","package":"suse-manager-5.0-s390x-server-image","fixed_in":["5.0.5.1-7.31.17"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 5.0","package":"suse-manager-5.0-s390x-server-migration-14-16-image","fixed_in":["5.0.5.1-7.24.12"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 5.0","package":"suse-manager-5.0-x86_64-server-attestation-image","fixed_in":["5.0.5.1-6.28.7"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 5.0","package":"suse-manager-5.0-x86_64-server-hub-xmlrpc-api-image","fixed_in":["5.0.5.1-6.24.9"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 5.0","package":"suse-manager-5.0-x86_64-server-image","fixed_in":["5.0.5.1-7.31.17"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 5.0","package":"suse-manager-5.0-x86_64-server-migration-14-16-image","fixed_in":["5.0.5.1-7.24.12"],"sources":["osv"]},{"ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"Multi-Linux-Manager-Proxy-SLE-release","fixed_in":["5.1-150700.16.3.6"],"sources":["osv"]},{"ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-aarch64-proxy-httpd-image","fixed_in":["5.1.1-8.7.30"],"sources":["osv"]},{"ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-aarch64-proxy-salt-broker-image","fixed_in":["5.1.1-9.5.45"],"sources":["osv"]},{"ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-aarch64-proxy-squid-image","fixed_in":["5.1.1-8.5.20"],"sources":["osv"]},{"ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-aarch64-proxy-ssh-image","fixed_in":["5.1.1-8.5.20"],"sources":["osv"]},{"ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-aarch64-proxy-tftpd-image","fixed_in":["5.1.1-8.5.20"],"sources":["osv"]},{"ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-ppc64le-proxy-httpd-image","fixed_in":["5.1.1-8.7.30"],"sources":["osv"]},{"ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-ppc64le-proxy-salt-broker-image","fixed_in":["5.1.1-9.5.45"],"sources":["osv"]},{"ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-ppc64le-proxy-squid-image","fixed_in":["5.1.1-8.5.20"],"sources":["osv"]},{"ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-ppc64le-proxy-ssh-image","fixed_in":["5.1.1-8.5.20"],"sources":["osv"]},{"ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-ppc64le-proxy-tftpd-image","fixed_in":["5.1.1-8.5.20"],"sources":["osv"]},{"ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-s390x-proxy-httpd-image","fixed_in":["5.1.1-8.7.30"],"sources":["osv"]},{"ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-s390x-proxy-salt-broker-image","fixed_in":["5.1.1-9.5.45"],"sources":["osv"]},{"ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-s390x-proxy-squid-image","fixed_in":["5.1.1-8.5.20"],"sources":["osv"]},{"ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-s390x-proxy-ssh-image","fixed_in":["5.1.1-8.5.20"],"sources":["osv"]},{"ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-s390x-proxy-tftpd-image","fixed_in":["5.1.1-8.5.20"],"sources":["osv"]},{"ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-x86_64-proxy-httpd-image","fixed_in":["5.1.1-8.7.30"],"sources":["osv"]},{"ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-x86_64-proxy-salt-broker-image","fixed_in":["5.1.1-9.5.45"],"sources":["osv"]},{"ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-x86_64-proxy-squid-image","fixed_in":["5.1.1-8.5.20"],"sources":["osv"]},{"ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-x86_64-proxy-ssh-image","fixed_in":["5.1.1-8.5.20"],"sources":["osv"]},{"ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-x86_64-proxy-tftpd-image","fixed_in":["5.1.1-8.5.20"],"sources":["osv"]},{"ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"uyuni-tools","fixed_in":["5.1.22-150700.3.7.4"],"sources":["osv"]},{"ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"Multi-Linux-Manager-Server-SLE-release","fixed_in":["5.1-150700.16.3.6"],"sources":["osv"]},{"ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-aarch64-server-attestation-image","fixed_in":["5.1.1-8.7.15"],"sources":["osv"]},{"ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-aarch64-server-hub-xmlrpc-api-image","fixed_in":["5.1.1-8.5.25"],"sources":["osv"]},{"ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-aarch64-server-image","fixed_in":["5.1.1-8.5.61"],"sources":["osv"]},{"ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-aarch64-server-migration-14-16-image","fixed_in":["5.1.1-8.5.38"],"sources":["osv"]},{"ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-aarch64-server-postgresql-image","fixed_in":["5.1.1-6.5.7"],"sources":["osv"]},{"ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-aarch64-server-saline-image","fixed_in":["5.1.1-9.5.35"],"sources":["osv"]},{"ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-ppc64le-server-attestation-image","fixed_in":["5.1.1-8.7.15"],"sources":["osv"]},{"ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-ppc64le-server-hub-xmlrpc-api-image","fixed_in":["5.1.1-8.5.25"],"sources":["osv"]},{"ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-ppc64le-server-image","fixed_in":["5.1.1-8.5.61"],"sources":["osv"]},{"ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-ppc64le-server-migration-14-16-image","fixed_in":["5.1.1-8.5.38"],"sources":["osv"]},{"ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-ppc64le-server-postgresql-image","fixed_in":["5.1.1-6.5.7"],"sources":["osv"]},{"ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-ppc64le-server-saline-image","fixed_in":["5.1.1-9.5.35"],"sources":["osv"]},{"ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-s390x-server-attestation-image","fixed_in":["5.1.1-8.7.15"],"sources":["osv"]},{"ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-s390x-server-hub-xmlrpc-api-image","fixed_in":["5.1.1-8.5.25"],"sources":["osv"]},{"ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-s390x-server-image","fixed_in":["5.1.1-8.5.61"],"sources":["osv"]},{"ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-s390x-server-migration-14-16-image","fixed_in":["5.1.1-8.5.38"],"sources":["osv"]},{"ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-s390x-server-postgresql-image","fixed_in":["5.1.1-6.5.7"],"sources":["osv"]},{"ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-s390x-server-saline-image","fixed_in":["5.1.1-9.5.35"],"sources":["osv"]},{"ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-x86_64-server-attestation-image","fixed_in":["5.1.1-8.7.15"],"sources":["osv"]},{"ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-x86_64-server-hub-xmlrpc-api-image","fixed_in":["5.1.1-8.5.25"],"sources":["osv"]},{"ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-x86_64-server-image","fixed_in":["5.1.1-8.5.61"],"sources":["osv"]},{"ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-x86_64-server-migration-14-16-image","fixed_in":["5.1.1-8.5.38"],"sources":["osv"]},{"ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-x86_64-server-postgresql-image","fixed_in":["5.1.1-6.5.7"],"sources":["osv"]},{"ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-x86_64-server-saline-image","fixed_in":["5.1.1-9.5.35"],"sources":["osv"]},{"ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"uyuni-tools","fixed_in":["5.1.22-150700.3.7.4"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"mybatis","fixed_in":["3.5.19-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"ognl","fixed_in":["3.4.7-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"ognl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.3-7","2.7.3-8","2.7.3-9"]},{"source":"osv","ecosystem":"Debian:13","package":"ognl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.3-8","2.7.3-9"]},{"source":"osv","ecosystem":"Debian:14","package":"ognl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.3-8","2.7.3-9"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"mybatis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.19-150200.5.9.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"ognl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.7-150200.5.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 5.0","package":"suse-manager-5.0-aarch64-proxy-httpd-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5.1-7.24.21"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 5.0","package":"suse-manager-5.0-aarch64-proxy-salt-broker-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5.1-7.26.21"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 5.0","package":"suse-manager-5.0-aarch64-proxy-squid-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5.1-7.24.7"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 5.0","package":"suse-manager-5.0-aarch64-proxy-ssh-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5.1-7.24.7"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 5.0","package":"suse-manager-5.0-aarch64-proxy-tftpd-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5.1-7.24.7"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 5.0","package":"suse-manager-5.0-ppc64le-proxy-httpd-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5.1-7.24.21"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 5.0","package":"suse-manager-5.0-ppc64le-proxy-salt-broker-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5.1-7.26.21"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 5.0","package":"suse-manager-5.0-ppc64le-proxy-squid-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5.1-7.24.7"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 5.0","package":"suse-manager-5.0-ppc64le-proxy-ssh-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5.1-7.24.7"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 5.0","package":"suse-manager-5.0-ppc64le-proxy-tftpd-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5.1-7.24.7"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 5.0","package":"suse-manager-5.0-s390x-proxy-httpd-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5.1-7.24.21"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 5.0","package":"suse-manager-5.0-s390x-proxy-salt-broker-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5.1-7.26.21"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 5.0","package":"suse-manager-5.0-s390x-proxy-squid-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5.1-7.24.7"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 5.0","package":"suse-manager-5.0-s390x-proxy-ssh-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5.1-7.24.7"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 5.0","package":"suse-manager-5.0-s390x-proxy-tftpd-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5.1-7.24.7"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 5.0","package":"suse-manager-5.0-x86_64-proxy-httpd-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5.1-7.24.21"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 5.0","package":"suse-manager-5.0-x86_64-proxy-salt-broker-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5.1-7.26.21"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 5.0","package":"suse-manager-5.0-x86_64-proxy-squid-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5.1-7.24.7"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 5.0","package":"suse-manager-5.0-x86_64-proxy-ssh-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5.1-7.24.7"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 5.0","package":"suse-manager-5.0-x86_64-proxy-tftpd-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5.1-7.24.7"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server Extension 5.0","package":"suse-manager-5.0-aarch64-proxy-httpd-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5.1-7.24.21"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server Extension 5.0","package":"suse-manager-5.0-aarch64-proxy-salt-broker-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5.1-7.26.21"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server Extension 5.0","package":"suse-manager-5.0-aarch64-proxy-squid-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5.1-7.24.7"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server Extension 5.0","package":"suse-manager-5.0-aarch64-proxy-ssh-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5.1-7.24.7"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server Extension 5.0","package":"suse-manager-5.0-aarch64-proxy-tftpd-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5.1-7.24.7"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server Extension 5.0","package":"suse-manager-5.0-ppc64le-proxy-httpd-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5.1-7.24.21"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server Extension 5.0","package":"suse-manager-5.0-ppc64le-proxy-salt-broker-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5.1-7.26.21"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server Extension 5.0","package":"suse-manager-5.0-ppc64le-proxy-squid-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5.1-7.24.7"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server Extension 5.0","package":"suse-manager-5.0-ppc64le-proxy-ssh-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5.1-7.24.7"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server Extension 5.0","package":"suse-manager-5.0-ppc64le-proxy-tftpd-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5.1-7.24.7"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server Extension 5.0","package":"suse-manager-5.0-s390x-proxy-httpd-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5.1-7.24.21"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server Extension 5.0","package":"suse-manager-5.0-s390x-proxy-salt-broker-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5.1-7.26.21"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server Extension 5.0","package":"suse-manager-5.0-s390x-proxy-squid-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5.1-7.24.7"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server Extension 5.0","package":"suse-manager-5.0-s390x-proxy-ssh-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5.1-7.24.7"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server Extension 5.0","package":"suse-manager-5.0-s390x-proxy-tftpd-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5.1-7.24.7"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server Extension 5.0","package":"suse-manager-5.0-x86_64-proxy-httpd-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5.1-7.24.21"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server Extension 5.0","package":"suse-manager-5.0-x86_64-proxy-salt-broker-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5.1-7.26.21"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server Extension 5.0","package":"suse-manager-5.0-x86_64-proxy-squid-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5.1-7.24.7"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server Extension 5.0","package":"suse-manager-5.0-x86_64-proxy-ssh-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5.1-7.24.7"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server Extension 5.0","package":"suse-manager-5.0-x86_64-proxy-tftpd-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5.1-7.24.7"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 5.0","package":"suse-manager-5.0-aarch64-server-attestation-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5.1-6.28.7"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 5.0","package":"suse-manager-5.0-aarch64-server-hub-xmlrpc-api-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5.1-6.24.9"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 5.0","package":"suse-manager-5.0-aarch64-server-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5.1-7.31.17"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 5.0","package":"suse-manager-5.0-aarch64-server-migration-14-16-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5.1-7.24.12"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 5.0","package":"suse-manager-5.0-ppc64le-server-attestation-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5.1-6.28.7"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 5.0","package":"suse-manager-5.0-ppc64le-server-hub-xmlrpc-api-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5.1-6.24.9"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 5.0","package":"suse-manager-5.0-ppc64le-server-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5.1-7.31.17"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 5.0","package":"suse-manager-5.0-ppc64le-server-migration-14-16-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5.1-7.24.12"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 5.0","package":"suse-manager-5.0-s390x-server-attestation-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5.1-6.28.7"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 5.0","package":"suse-manager-5.0-s390x-server-hub-xmlrpc-api-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5.1-6.24.9"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 5.0","package":"suse-manager-5.0-s390x-server-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5.1-7.31.17"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 5.0","package":"suse-manager-5.0-s390x-server-migration-14-16-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5.1-7.24.12"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 5.0","package":"suse-manager-5.0-x86_64-server-attestation-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5.1-6.28.7"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 5.0","package":"suse-manager-5.0-x86_64-server-hub-xmlrpc-api-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5.1-6.24.9"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 5.0","package":"suse-manager-5.0-x86_64-server-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5.1-7.31.17"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 5.0","package":"suse-manager-5.0-x86_64-server-migration-14-16-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5.1-7.24.12"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy LTS 4.3","package":"release-notes-susemanager-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.16.1-150400.3.101.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server LTS 4.3","package":"release-notes-susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.16.1-150400.3.143.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"Multi-Linux-Manager-Proxy-SLE-release","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1-150700.16.3.6"}]}]},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-aarch64-proxy-httpd-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1-8.7.30"}]}]},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-aarch64-proxy-salt-broker-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1-9.5.45"}]}]},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-aarch64-proxy-squid-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1-8.5.20"}]}]},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-aarch64-proxy-ssh-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1-8.5.20"}]}]},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-aarch64-proxy-tftpd-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1-8.5.20"}]}]},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-ppc64le-proxy-httpd-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1-8.7.30"}]}]},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-ppc64le-proxy-salt-broker-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1-9.5.45"}]}]},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-ppc64le-proxy-squid-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1-8.5.20"}]}]},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-ppc64le-proxy-ssh-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1-8.5.20"}]}]},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-ppc64le-proxy-tftpd-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1-8.5.20"}]}]},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-s390x-proxy-httpd-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1-8.7.30"}]}]},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-s390x-proxy-salt-broker-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1-9.5.45"}]}]},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-s390x-proxy-squid-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1-8.5.20"}]}]},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-s390x-proxy-ssh-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1-8.5.20"}]}]},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-s390x-proxy-tftpd-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1-8.5.20"}]}]},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-x86_64-proxy-httpd-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1-8.7.30"}]}]},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-x86_64-proxy-salt-broker-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1-9.5.45"}]}]},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-x86_64-proxy-squid-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1-8.5.20"}]}]},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-x86_64-proxy-ssh-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1-8.5.20"}]}]},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-x86_64-proxy-tftpd-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1-8.5.20"}]}]},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Proxy Extension for SLE 5.1","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.22-150700.3.7.4"}]}]},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"Multi-Linux-Manager-Server-SLE-release","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1-150700.16.3.6"}]}]},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-aarch64-server-attestation-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1-8.7.15"}]}]},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-aarch64-server-hub-xmlrpc-api-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1-8.5.25"}]}]},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-aarch64-server-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1-8.5.61"}]}]},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-aarch64-server-migration-14-16-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1-8.5.38"}]}]},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-aarch64-server-postgresql-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1-6.5.7"}]}]},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-aarch64-server-saline-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1-9.5.35"}]}]},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-ppc64le-server-attestation-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1-8.7.15"}]}]},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-ppc64le-server-hub-xmlrpc-api-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1-8.5.25"}]}]},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-ppc64le-server-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1-8.5.61"}]}]},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-ppc64le-server-migration-14-16-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1-8.5.38"}]}]},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-ppc64le-server-postgresql-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1-6.5.7"}]}]},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-ppc64le-server-saline-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1-9.5.35"}]}]},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-s390x-server-attestation-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1-8.7.15"}]}]},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-s390x-server-hub-xmlrpc-api-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1-8.5.25"}]}]},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-s390x-server-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1-8.5.61"}]}]},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-s390x-server-migration-14-16-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1-8.5.38"}]}]},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-s390x-server-postgresql-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1-6.5.7"}]}]},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-s390x-server-saline-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1-9.5.35"}]}]},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-x86_64-server-attestation-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1-8.7.15"}]}]},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-x86_64-server-hub-xmlrpc-api-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1-8.5.25"}]}]},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-x86_64-server-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1-8.5.61"}]}]},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-x86_64-server-migration-14-16-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1-8.5.38"}]}]},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-x86_64-server-postgresql-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1-6.5.7"}]}]},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"suse-multi-linux-manager-5.1-x86_64-server-saline-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1-9.5.35"}]}]},{"source":"osv","ecosystem":"SUSE:Multi-Linux Manager Server Extension for SLE 5.1","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.22-150700.3.7.4"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ognl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.3-5","2.7.3-6"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"ognl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.3-6","2.7.3-7"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"ognl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.3-7"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ognl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.3-7"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"ognl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.3-7","2.7.3-8"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"ognl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.3-8"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"ognl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.3-9"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"ognl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.3-8","2.7.3-9"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"mybatis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.19-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ognl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.7-1.1"}]}]}],"products":[{"vendor":"apache","product":"commons_ognl"},{"vendor":"apache software foundation","product":"apache commons ognl"}],"references":[{"url":"https://lists.apache.org/thread/2gj8tjl6vz949nnp3yxz3okm9xz2k7sp","tags":["vendor-advisory","Mailing List","article","report"]},{"url":"http://www.openwall.com/lists/oss-security/2025/08/18/4"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-53192"},{"url":"https://github.com/advisories/GHSA-5vgh-76mj-8hcq"},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-53192","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202503285-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1248252","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53192","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20253825-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20253827-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1246277","tags":["report"]},{"url":"https://bugzilla.suse.com/1246439","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53880","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53883","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20253839-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1229825","tags":["report"]},{"url":"https://bugzilla.suse.com/1243331","tags":["report"]},{"url":"https://bugzilla.suse.com/1243486","tags":["report"]},{"url":"https://bugzilla.suse.com/1243611","tags":["report"]},{"url":"https://bugzilla.suse.com/1243704","tags":["report"]},{"url":"https://bugzilla.suse.com/1244027","tags":["report"]},{"url":"https://bugzilla.suse.com/1244127","tags":["report"]},{"url":"https://bugzilla.suse.com/1244219","tags":["report"]},{"url":"https://bugzilla.suse.com/1245099","tags":["report"]},{"url":"https://bugzilla.suse.com/1245120","tags":["report"]},{"url":"https://bugzilla.suse.com/1245702","tags":["report"]},{"url":"https://bugzilla.suse.com/1246068","tags":["report"]},{"url":"https://bugzilla.suse.com/1246320","tags":["report"]},{"url":"https://bugzilla.suse.com/1246553","tags":["report"]},{"url":"https://bugzilla.suse.com/1246789","tags":["report"]},{"url":"https://bugzilla.suse.com/1246882","tags":["report"]},{"url":"https://bugzilla.suse.com/1246906","tags":["report"]},{"url":"https://bugzilla.suse.com/1247688","tags":["report"]},{"url":"https://bugzilla.suse.com/1247836","tags":["report"]},{"url":"https://bugzilla.suse.com/1249434","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-53192","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-53192","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2025/08/18/4","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-53192","title":"Apache Commons OGNL: Expression Injection leading to RCE","description":"** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Expression/Command Delimiters vulnerability in Apache Commons OGNL.\n\nThis issue affects Apache Commons OGNL: all versions.\n\n\n\nWhen using the API Ognl.getValue​, the OGNL engine parses and evaluates the provided expression with powerful capabilities, including accessing and invoking related methods,\n etc. Although OgnlRuntime attempts to restrict certain dangerous classes and methods (such as java.lang.Runtime) through a blocklist, these restrictions are not comprehensive. \nAttackers may be able to bypass the restrictions by leveraging class objects that are not covered by the blocklist and potentially achieve arbitrary code execution.\n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\n\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer.","status":"published","published":"2025-08-18T20:09:31.206Z","modified":"2025-11-04T21:11:44.989Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-146"],"updated_at":"2026-11-02T14:32:49.180768Z"}],"euvd":[{"id":"EUVD-2025-28495","description":"** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Expression/Command Delimiters vulnerability in Apache Commons OGNL.\n\nThis issue affects Apache Commons OGNL: all versions.\n\n\n\nWhen using the API Ognl.getValue​, the OGNL engine parses and evaluates the provided expression with powerful capabilities, including accessing and invoking related methods,\n etc. Although OgnlRuntime attempts to restrict certain dangerous classes and methods (such as java.lang.Runtime) through a blocklist, these restrictions are not comprehensive. \nAttackers may be able to bypass the restrictions by leveraging class objects that are not covered by the blocklist and potentially achieve arbitrary code execution.\n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\n\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer.","status":"published","published":"2025-08-18T20:09:31Z","modified":"2025-11-04T21:11:44Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:49:21.143143Z"}],"ghsa":[{"id":"GHSA-5vgh-76mj-8hcq","title":"** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Expression/Command Delimiters...","description":"** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Expression/Command Delimiters vulnerability in Apache Commons OGNL.\n\nThis issue affects Apache Commons OGNL: all versions.\n\n\n\nWhen using the API Ognl.getValue​, the OGNL engine parses and evaluates the provided expression with powerful capabilities, including accessing and invoking related methods,\n etc. Although OgnlRuntime attempts to restrict certain dangerous classes and methods (such as java.lang.Runtime) through a blocklist, these restrictions are not comprehensive. \nAttackers may be able to bypass the restrictions by leveraging class objects that are not covered by the blocklist and potentially achieve arbitrary code execution.\n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\n\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer.","status":"published","published":"2025-08-18T21:31:19Z","modified":"2025-11-05T00:32:30Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-146"],"updated_at":"2026-11-02T15:04:39.50413Z"}],"nvd":[{"id":"CVE-2025-53192","description":"** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Expression/Command Delimiters vulnerability in Apache Commons OGNL.\n\nThis issue affects Apache Commons OGNL: all versions.\n\n\n\nWhen using the API Ognl.getValue​, the OGNL engine parses and evaluates the provided expression with powerful capabilities, including accessing and invoking related methods,\n etc. Although OgnlRuntime attempts to restrict certain dangerous classes and methods (such as java.lang.Runtime) through a blocklist, these restrictions are not comprehensive. \nAttackers may be able to bypass the restrictions by leveraging class objects that are not covered by the blocklist and potentially achieve arbitrary code execution.\n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\n\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer.","status":"published","published":"2025-08-18T20:15:29.63Z","modified":"2026-06-17T09:37:46.567Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-146"],"updated_at":"2026-11-02T14:11:24.730342Z"}],"osv":[{"id":"DEBIAN-CVE-2025-53192","description":"** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Expression/Command Delimiters vulnerability in Apache Commons OGNL.  This issue affects Apache Commons OGNL: all versions.    When using the API Ognl.getValue​, the OGNL engine parses and evaluates the provided expression with powerful capabilities, including accessing and invoking related methods,  etc. Although OgnlRuntime attempts to restrict certain dangerous classes and methods (such as java.lang.Runtime) through a blocklist, these restrictions are not comprehensive.  Attackers may be able to bypass the restrictions by leveraging class objects that are not covered by the blocklist and potentially achieve arbitrary code execution.  As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.   NOTE: This vulnerability only affects products that are no longer supported by the maintainer.","status":"published","published":"2025-08-18T20:15:29.63Z","modified":"2026-09-01T20:05:54.25061608Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:47.378563Z"},{"id":"UBUNTU-CVE-2025-53192","description":"** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Expression/Command Delimiters vulnerability in Apache Commons OGNL. This issue affects Apache Commons OGNL: all versions. When using the API Ognl.getValue​, the OGNL engine parses and evaluates the provided expression with powerful capabilities, including accessing and invoking related methods,  etc. Although OgnlRuntime attempts to restrict certain dangerous classes and methods (such as java.lang.Runtime) through a blocklist, these restrictions are not comprehensive. Attackers may be able to bypass the restrictions by leveraging class objects that are not covered by the blocklist and potentially achieve arbitrary code execution. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.","status":"published","published":"2025-08-18T20:15:00Z","modified":"2026-10-17T12:57:07.416966356Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:50.31802Z"},{"id":"CVE-2025-53192","description":"** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Expression/Command Delimiters vulnerability in Apache Commons OGNL.\n\nThis issue affects Apache Commons OGNL: all versions.\n\n\n\nWhen using the API Ognl.getValue​, the OGNL engine parses and evaluates the provided expression with powerful capabilities, including accessing and invoking related methods,\n etc. Although OgnlRuntime attempts to restrict certain dangerous classes and methods (such as java.lang.Runtime) through a blocklist, these restrictions are not comprehensive. \nAttackers may be able to bypass the restrictions by leveraging class objects that are not covered by the blocklist and potentially achieve arbitrary code execution.\n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\n\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer.","status":"published","published":"2025-08-18T20:15:29Z","modified":"2026-04-10T05:30:48.636774Z","updated_at":"2026-11-02T15:44:50.45326Z"},{"id":"openSUSE-SU-2025:15567-1","title":"mybatis-3.5.19-1.1 on GA media","description":"These are all security issues fixed in the mybatis-3.5.19-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-09-19T00:00:00Z","modified":"2026-03-23T04:53:56.472249Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2025:15568-1","title":"ognl-3.4.7-1.1 on GA media","description":"These are all security issues fixed in the ognl-3.4.7-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-09-19T00:00:00Z","modified":"2026-03-23T04:53:56.736409Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"SUSE-SU-2025:03285-1","title":"Security update for mybatis, ognl","description":"This update for mybatis, ognl fixes the following issues:\n\nVersion update to 3.5.7:\n\n  * Bug fixes:\n\n    + Improved performance under JDK 8. #2223\n\nVersion update to 3.5.8:\n\n  * List of changes:\n\n    + Avoid NullPointerException when mapping an empty string to\n      java.lang.Character. #2368\n    + Fixed an incorrect argument when initializing static object.\n      This resolves a compatibility issue with quarkus-mybatis.\n      #2284\n    + Performance improvements. #2297 #2335 #2340\n\nVersion update to 3.5.9:\n\n  * List of changes:\n\n    + Add nullable to \u003cforeach /\u003e. If enabled, it skips the\n      iteration when the collection is null instead of throwing an\n      exception. To enable this feature globally, set\n      nullableOnForEach=true in the config. #1883\n\nVersion update to 3.5.10:\n\n  * Bug fixes:\n\n    + Unexpected illegal reflective access warning (or\n      InaccessibleObjectException on Java 16+) when calling method\n      in OGNL expression. #2392\n    + IllegalAccessException when auto-mapping Records (JEP-359)\n      #2195\n    + 'interrupted' status is not set when\n       PooledConnection#getConnection() is interrupted. #2503\n\n  * Enhancements:\n\n    + A new option argNameBasedConstructorAutoMapping is added. If\n      enabled, constructor argument names are used to look up\n      columns when auto-mapping. #2192\n    + Added a new property skipSetAutoCommitOnClose to\n      JdbcTransactionFactory. Skipping setAutoCommit() call could\n      improve performance with some drivers. #2426\n    + \u003cidArg /\u003e can now be listed after \u003carg /\u003e in \u003cconstructor /\u003e.\n      #2541\n\nVersion update to 3.5.11:\n\n  * Bug fixes:\n\n    + OGNL could throw IllegalArgumentException when invoking\n      inherited method. #2609\n    + returnInstanceForEmptyRow is not applied to constructor\n      auto-mapping. #2665\n\nVersion update to 3.5.12\n\n  * User impactful changes\n\n    + #2703 Referencing collection parameter by name fails fixing\n      #2693\n    + #2709 Fix a race condition caused by other threads calling\n      mapper methods while mapped tables are being constructed\n    + #2727 Enable ability to provide custom configuration to\n      XMLConfigBuilder\n    + #2731 Adding mapper could fail under JPMS\n    + #2741 Add 'affectedData' attribute to @select,\n      @SelectProvider, and \u003cselect /\u003e\n    + #2767 Resolve resultType by namespace and id when not\n      provided resultType and resultMap\n    + #2804 Search readable property when resolving constructor arg\n      type by name\n    + Minor correction: 'boolean' can never be null (primative)\n    + General library updates\n    + Uses parameters option for compiler now (needed by spring boot\n      3) (for reflection needs)\n\n  * Code cleanup\n\n    + #2816 Use open rewrite to partially cleanup java code\n    + #2817 Add private constructors per open rewrite\n    + #2819 Add final where appropriate per open rewrite\n    + #2825 Cleanup if statement breaks / return logic\n    + #2826 Eclipse based cleanup\n\n  * Build\n\n    + #2820 Remove test ci group profile in favor of more direct\n      usage on GH-Actions and update deprecated surefire along in\n      overview in README.md\n    + Adjustments to build so shaded ognl and javassist no longer\n      throw warnings\n    + Build with jdk 21-ea as well now\n    + Various test cleanup, updates, and additions\n    + Turn on auto formatting of all java code including note to\n      contributors on readme to skip formatting when necessary in\n      code blocks\n    + Tests may use jdk 11 now while retaining jdk 8 runtime\n    + Pom cleanup / better clarification on parameters\n\n  * Documentation\n\n    + Various documentation updates\n\nVersion update to 3.5.13:\n\n  * Bug fix:\n\n    + Unable to resolve result type when the target property has\n      a getter with different return type #2834\n\nVersion update to 3.5.14:\n\n  * Bug fixes:\n\n    + Registered type handler is not used for anonymous enums #2956\n    + Discriminator does not work in constructor mapping #2913\n\nVersion update to 3.5.15:\n\n  * Changes\n\n    + XNode#toString() should output all child nodes. See #3001 and\n      associated tickets on this issue\n    + Fix performance of mappedColumnNames.contains by using 'set'\n      rather than 'list'. See #3023\n    + Fix osgi issue with javassist. See #3031\n    + Updated shaded OGNL to 3.4.2. See #3035\n    + Add support method for generating dynamic sql on SQL class.\n      See #2887\n    + General library updates\n    + General document updates\n\n  * Build\n\n    + We now show builds from java 11, 17, 21, and 22 on Github\n      Actions. Code is still java 8 compatible at this time.\n    + Update vulnerable hsqldb to 2.7.2 fixing our tests that now\n      work due to newer support. Note, users were never affected by\n      this but at least one user pull request was attempted opened\n      in addition to both renovate and dependabot and various\n      reporting on it.\n    + Now using more properties to define versions in pom to lower\n      the frequency of pull requests from renovate\n\nVersion update to 3.5.16:\n\n  * Security:\n\n    + Prevent Invocation from being used by vulnerable applications.\n      #3115\n\n  * Bugs:\n\n    + When database ID resolution is failed, invalid bound statement\n      is used. #3040\n\n  * Enhancements:\n\n    + It is now possible to write a custom map wrapper to customize\n      how to map column name with dots or brackets. #13 #3062\n\n  * Performance:\n\n    + Improved compatibility with Virtual Threads introduced by\n      Loom.\n    + Reduced memory footprint when performing the default (i.e.\n      order based) constructor auto-mapping. #3113\n\n  * Build:\n\n    + Include the shaded libraries (OGNL and Javassist) in the\n      sources.jar.\n\nVersion update to 3.5.17:\n\n  * Bugs:\n\n    + VendorDatabaseIdProvider#getDatabaseId() should return product\n      name when properties is empty #3297\n    + Update NClobTypeHandler to use methods for national character\n      set #3298\n\n  * Enhancements:\n\n    + Allow DefaultSqlSessionFactory to provide a custom\n      SqlSession #3128\n\nVersion update to 3.5.18:\n\n  * Regressions\n\n    + Fixed issue in 3.5.17 #3334\n\n  * New\n\n    + Ignore empty xnode per #3349\n    + Share expression validator #3339\n    + Throw helpful error instead of IndexOutOfBoundsException\n      (automapping) #3327\n    + Optimize mapper builder #3252\n\n  * Tests\n\n    + Add TransactionFactory, Transaction test cases #3277\n\n  * Build\n\n    + Reworked pom to match current java 17 build usage\n    + Moved all tests to newer java standards\n    + Cleaned up github actions\n    + Run 'site' branch only on release commits\n\nVersion update to 3.5.19:\n\n  * Revert Regression introduced by #3349.\n\n- Initial packaging with version 3.4.7\n\nognl replaces the EOLed apache-commons-ognl that has an unpatched\n  security bug (bsc#1248252, CVE-2025-53192)","status":"published","published":"2025-09-21T09:18:07Z","modified":"2026-03-23T04:48:01.30929Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:3825-1","title":"Recommended update 5.0.5.1 for Multi-Linux Manager Server","description":"This update fixes the following issues:\n\nserver-attestation-image:\n\n- CVE-2025-53192: Do not use apache-commons-ognl but its successor\n  ognl (bsc#1248252)\n- Image rebuilt to the newest version and updated build dependencies\n  \nserver-hub-xmlrpc-api-image, server-image, server-migration-14-16-image:\n\n- Images rebuilt to the newest version and updated build dependencies\n\n","status":"published","published":"2025-10-28T07:26:09Z","modified":"2026-02-04T04:00:29.809352Z","updated_at":"2026-11-02T15:54:00.344164Z"},{"id":"SUSE-SU-2025:3827-1","title":"Security update 4.3.16.1 for SUSE Manager Server Release Notes","description":"This update fixes the following issues:\n    \nrelease-notes-susemanager:\n\n- Update to SUSE Manager 4.3.16.1\n  * CVEs Fixed:\n    CVE-2025-53883, CVE-2025-53880, CVE-2025-53192\n  * Bugs mentioned:\n    bsc#1246439, bsc#1246277, bsc#1248252\n","status":"published","published":"2025-10-28T07:26:58Z","modified":"2026-02-04T04:20:42.019378Z","updated_at":"2026-11-02T15:54:00.344164Z"},{"id":"SUSE-SU-2025:3839-1","title":"Security update 5.1.1 for Multi-Linux Manager Server","description":"This update fixes the following issues:\n\nMulti-Linux-Manager-Server-SLE-release:\n\n- Update for the release packages for fixing the EOL \n- Fixed migration issue (bsc#1243486)\n\nserver-attestation-image was updated from version 5.1.7 to 5.1.10:\n    \n- CVE-2025-53192: Do not use apache-commons-ognl but its successor\n  ognl (bsc#1248252)\n- Image rebuilt to the newest version with updated dependencies\n\nserver-hub-xmlrpc-api-image was updated from version 5.1.7 to 5.1.9:\n\n- Image rebuilt to the newest version with updated dependencies\n\nserver-image was updated from version 5.1.7 to 5.1.9::\n\n- Version 5.1.9\n  * Install python311-ldap into the server-image (bsc#1245702)\n- Version 5.1.8\n  * Move jmx configuration to a persisting folder (bsc#1244219)\n\nserver-migration-14-16-image was updated from version 5.1.7 to 5.1.9:\n\n- Image rebuilt to the newest version with updated dependencies\n\nserver-postgresql-image was updated from version 5.1.5 to 5.1.7:\n\n- Image rebuilt to the newest version with updated dependencies\n\nserver-saline-image was updated from version 5.1.7 to 5.1.9:\n\n- Image rebuilt to the newest version with updated dependencies\n\nuyuni-tools was updated from version 5.1.18-0 to 5.1.22-0:\n\n- Version 5.1.22-0\n  * Fixed cobbler config migration to standalone files\n  * Fixed generated DB certificate subject alternate names\n- Version 5.1.21-0\n  * Removed extraneous quotes when getting the running image (bsc#1249434)\n- Version 5.1.20-0\n  * Added migration for server monitoring configuration (bsc#1247688)\n- Version 5.1.19-0\n  * Added a lowercase version of --logLevel (bsc#1243611)\n  * Stop executing scripts in temporary folder (bsc#1243704)\n  * support config: collect podman inspect for hub container (bsc#1245099)\n  * Use a new dedicated path for Cobbler settings (bsc#1244027)\n  * Migrated custom auto installation snippets (bsc#1246320)\n  * Added SUSE Linux Enterprise 15 SP7 to buildin productmap\n  * Fixed loading product map from mgradm configuration file (bsc#1246068)\n  * Fixed channel override for distro copy\n  * Do not use sudo when running as a root user (bsc#1246882)\n  * Do not require backups to be at the same location for restoring (bsc#1246906)\n  * Fixed recomputing proxy images when installing a PTF or TEST (bsc#1246553)\n  * Added mgradm server rename to change the server FQDN (bsc#1229825)\n  * If no DB SSL CA parameter is given, use the other one (bsc#1245120)\n  * Made mgradm stop more fault tolerant (bsc#1243331)\n  * Backup systemd dropin directory too and create if missing\n  * Added 3rd party SSL options for upgrade and migration scenarios\n  * Do not consider stderr output of podman as an error (bsc#1247836)\n  * Restored SELinux contexts for restored backup volumes (bsc#1244127)\n  * Automatically get up-to-date systemid file on salt based proxy hosts (bsc#1246789)\n  * Bumped the default image tag to 5.1.1\n\nHow to apply this update:\n\n1. Log in as root user to the SUSE Multi-Linux Manager Server.\n2. Upgrade mgradm and mgrctl.\n3. If you are in a disconnected environment, upgrade the image packages.\n4. Reboot the system.\n5. Run `mgradm upgrade podman` which will use the default image tags.\n","status":"published","published":"2025-10-28T14:41:29Z","modified":"2026-03-23T04:49:19.800407Z","updated_at":"2026-11-02T15:54:00.344164Z"}]}}