[BEANUTILS-520] Mitigate CVE-2014-0114

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.9.3
• Fix Version/s: 1.9.4, 2.0.0
• Component/s: Bean / Property Utils
• Labels: security
• External issue URL: https://nvd.nist.gov/vuln/detail/CVE-2014-0114
• External issue ID: CVE-2014-0114
• Assignee: Rob Tompkins
• Reporter: Melloware
• Created: 21/May/19 13:13
• Updated: 08/Oct/22 00:40
• Resolved: 15/Jun/19 15:31

Description

https://nvd.nist.gov/vuln/detail/CVE-2014-0114

Due to the above CVE in 1.9.2 they added a Suppression but it is still being marked as a security risk through most major checks from OWASP and Sonatype IQ.

"commons-beanutils added a SuppressPropertiesBeanIntrospector which includes a specialized instance of itself as the SUPPRESS_CLASS constant beginning in version 1.9.2 that specifically suppresses the class property. However, this fix is not enabled by default."

For BeanUtils2 why not make this the default and have people "enable" it if it they want to get the feature.

Thanks for your consideration.

Issue Links

• links to: GitHub Pull Request #7