CVE-2024-29131: apache software foundation apache commons configuration Out-of-bounds Write

CVSS: 7.3v3.1HighAnalyzed

AliasesUBUNTU-CVE-2024-29131DEBIAN-CVE-2024-29131CGA-262h-mcfp-f743+150 more

Published 21-03-2024Last modified 13-02-2025

Vulnerability summary

CVE-2024-29131 is a high (CVSS 7.3) Out-of-bounds Write vulnerability in apache software foundation apache commons configuration. EPSS estimates a 2.05% chance of exploitation in the next 30 days, higher than 80.9% of scored vulnerabilities.

Overall risk

30/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.3/10

010

High · v3.1 (CVE.org)

EPSS score

2.05%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 3 · Related 8

OPENSUSE-SU-2024:13791-1 SUSE-SU-2024:1365-1 SUSE-SU-2024:1377-1 CGA-2V4P-JWQH-9WQP CGA-7C8F-R5CG-XMWR CGA-GRW7-F4VJ-7JVV+2 more

Timeline

21-03-2024
PublishedVulnerability first disclosed.
13-02-2025
Last modifiedVulnerability information updated.

Description

Out-of-bounds Write vulnerability in Apache Commons Configuration.This issue affects Apache Commons Configuration: from 2.0 before 2.10.1. Users are recommended to upgrade to version 2.10.1, which fixes the issue.

CVSS metrics

7 scores · 7 sources · 1 version

v3.17.3

EPSS trend

Probability

2.05%

Chance of exploitation in the next 30 days

Percentile

81%

Versus all other CVEs

30-day change

0.00 pp

From 2.05% on 19-09-2026

19-09-202619-10-2026

EPSS score

2.05%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.

Affected systems

Chainguard70 products

cassandra-reaper< 3.6.0-r0
celeborn-0.5< 0.5.4-r26
celeborn-0.6< 0.6.3-r7
druid< 37.0.0-r56 | < 34.0.0-r6 | < 37.0.0-r14
hadoop-client-modules< 3.3.6-r2

hadoop-fips-3.3.6All versions (No fix recorded)
spark-3.5-scala-2.12All versions (No fix recorded)
spark-3.5-scala-2.13All versions (No fix recorded)
spark-fips-3.5-scala-2.12All versions (No fix recorded)
spark-fips-3.5-scala-2.13All versions (No fix recorded)
tez< 0.10.4-r6
trino< 444-r1
trino-config< 444-r1
trino-oci-entrypoint< 444-r1
trino-plugin-ai-functions< 444-r1
trino-plugin-bigquery< 444-r1
trino-plugin-blackhole< 444-r1
trino-plugin-cassandra< 444-r1
trino-plugin-clickhouse< 444-r1
trino-plugin-delta-lake< 444-r1
trino-plugin-druid< 444-r1
trino-plugin-duckdb< 444-r1
trino-plugin-elasticsearch< 444-r1
trino-plugin-exasol< 444-r1
trino-plugin-exchange-filesystem< 444-r1
trino-plugin-exchange-hdfs< 444-r1
trino-plugin-faker< 444-r1
trino-plugin-functions-python< 444-r1
trino-plugin-geospatial< 444-r1
trino-plugin-google-sheets< 444-r1
trino-plugin-hive< 444-r1
trino-plugin-http-event-listener< 444-r1
trino-plugin-http-server-event-listener< 444-r1
trino-plugin-hudi< 444-r1
trino-plugin-iceberg< 444-r1
trino-plugin-ignite< 444-r1
trino-plugin-jmx< 444-r1
trino-plugin-kafka< 444-r1
trino-plugin-kafka-event-listener< 444-r1
trino-plugin-lakehouse< 444-r1
trino-plugin-ldap-group-provider< 444-r1
trino-plugin-loki< 444-r1
trino-plugin-mariadb< 444-r1
trino-plugin-memory< 444-r1
trino-plugin-ml< 444-r1
trino-plugin-mongodb< 444-r1
trino-plugin-mysql< 444-r1
trino-plugin-mysql-event-listener< 444-r1
trino-plugin-opa< 444-r1
trino-plugin-openlineage< 444-r1
trino-plugin-opensearch< 444-r1
trino-plugin-oracle< 444-r1
trino-plugin-password-authenticators< 444-r1
trino-plugin-pinot< 444-r1
trino-plugin-postgresql< 444-r1
trino-plugin-prometheus< 444-r1
trino-plugin-ranger< 444-r1
trino-plugin-redis< 444-r1
trino-plugin-redshift< 444-r1
trino-plugin-resource-group-managers< 444-r1
trino-plugin-session-property-managers< 444-r1
trino-plugin-singlestore< 444-r1
trino-plugin-snowflake< 444-r1
trino-plugin-spooling-filesystem< 444-r1
trino-plugin-sqlserver< 444-r1
trino-plugin-teradata-functions< 444-r1
trino-plugin-thrift< 444-r1
trino-plugin-tpcds< 444-r1
trino-plugin-tpch< 444-r1
trino-plugin-vertica< 444-r1

Show all 70

Wolfi63 products

cassandra-reaper< 3.6.0-r0
celeborn-0.6< 0.6.3-r7
druid< 37.0.0-r56 | < 34.0.0-r6 | < 37.0.0-r14
tez< 0.10.4-r6
trino< 444-r1

Show all 63

Netapp2 products

ontap_tools10
snapcenterna

Apache1 product

commons_configuration≥ 2.0, < 2.10.1

Apache software foundation1 product

apache commons configuration≥ 2.0, < 2.10.1

Debian1 product

commons-configuration2All versions (No fix recorded) | < 2.10.1-1

Fedoraproject1 product

fedoraEOL39 | 40

Org.apache.commons1 product

commons-configuration2≥ 2.0, < 2.10.1

Ubuntu1 product

commons-configuration2All versions (No fix recorded)

9 vendors · 141 products

References

18 links

lists.apache.org/thread/03nzzzjn4oknyw5y0871tw7ltj0t3r37Vendor AdvisoryAdvisoryWEBMailing List
lists.fedoraproject.org/archives/…WEBThird Party Advisory
lists.fedoraproject.org/archives/…WEBThird Party Advisory
www.openwall.com/lists/oss-security/2024/03/20/4WEBMailing ListThird Party Advisory
security.netapp.com/advisory/ntap-20241213-0001/AdvisoryThird Party Advisory
ubuntu.com/security/CVE-2024-29131REPORT
www.cve.org/CVERecord?id=CVE-2024-29131REPORT
www.openwall.com/lists/oss-security/2024/03/20/4REPORT
issues.apache.org/jira/browse/CONFIGURATION-840REPORTWEB
security-tracker.debian.org/tracker/CVE-2024-29131Advisory

Show all 18 references

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities