CVE-2024-29133: apache software foundation apache commons configuration Out-of-bounds Write
CVSS: 5.4v3.1MediumAnalyzed
AliasesUBUNTU-CVE-2024-29133DEBIAN-CVE-2024-29133CGA-22hm-mg76-p66cCGA-23j2-54v2-r4f6CGA-23j8-cjq9-6w57CGA-27x6-8vpr-6rcxCGA-2qp8-4jgv-f732CGA-2w2p-xcp5-6g83CGA-2x39-6qcp-j365CGA-3ghm-392m-7rvjCGA-3gq5-r26c-6w2gCGA-3gr7-786p-5xq2CGA-3h3g-m4v9-mv63CGA-3m87-vxh2-mhc9CGA-3qph-44fh-4cjgCGA-3rh7-3pfh-2qwpCGA-3xg6-gh5r-4q43CGA-3xj6-72ww-34xmCGA-4cgr-c73x-wv6vCGA-4mx7-wcp4-399vCGA-4v8x-x9f6-hx7gCGA-4xmq-c99f-8cr6CGA-5663-63cj-cj2fCGA-5gp2-678c-wf4hCGA-5hrf-w5jg-fxpqCGA-5jwr-pmm4-qvp9CGA-5r3j-2hrc-2rhrCGA-5v8m-pqqw-65v8CGA-5xv5-3986-8rggCGA-68cw-38pw-h4ccCGA-6cjq-xgc6-3g88CGA-6gj8-8885-vvv3CGA-6j9f-7m7v-prqfCGA-6r92-qxcm-x46cCGA-6v5w-pvc4-pr2cCGA-6xg4-624j-347jCGA-73jm-g8cr-64hvCGA-78jm-mj3x-cf77CGA-7jrq-rr5f-p6whCGA-7mmv-76wq-99p7CGA-7p98-pq63-q2x7CGA-7v9h-wgmr-r6cfCGA-7vwm-rjhg-grpgCGA-7ww7-3mjw-9x97CGA-8339-5c8q-ff7pCGA-844w-6vx5-2c7cCGA-855f-c22p-qp78CGA-88pw-xc39-hwp4CGA-896f-ch22-rw45CGA-8h3v-8x3c-3h5xCGA-8rcr-5v59-rgfpCGA-8rfp-wc5r-5xcvCGA-8wp4-5f9f-rp74CGA-933r-jjc7-8cfxCGA-93g4-gjf7-hqw2CGA-93q4-586c-8fxqCGA-9532-phhr-9w7gCGA-95hg-4gg2-356qCGA-978c-8vfc-xq2gCGA-98r4-jx8q-ffxcCGA-995c-jgxj-rpwmCGA-9cxh-r5q9-4r5xCGA-9f45-979w-4hcgCGA-9fjw-rhw9-465mCGA-9g86-757c-rvp7CGA-9rwj-wwfc-m339CGA-9vwr-g935-h8mfCGA-9w6c-xx59-j9xvCGA-cfcv-c8xr-x6q7CGA-cxxh-mwvq-m3x7CGA-f265-hp6r-4crpCGA-f3xp-2mpq-42x6CGA-f6m8-fmjr-69pwCGA-f8p4-g6rq-84jpCGA-f9h4-49cm-jf9cCGA-fcjg-q8x4-8pqpCGA-fr6h-5jh5-xc53CGA-fvmw-2hpr-wwwqCGA-fxwh-j9gp-hjqjCGA-g6mj-fgjg-gx63CGA-g6vp-4pr3-c736CGA-g9g3-w4mv-8xrpCGA-gf35-8cvg-qr62CGA-gfj7-8cfc-97jpCGA-h2p7-q6fv-xp25CGA-h7m9-h5pr-993cCGA-hmqj-qr56-23m4CGA-hpcv-jm3w-qf5rCGA-j3gr-9h8p-w99rCGA-j7cr-gvjq-3x3vCGA-j8r6-f2m5-7wg7CGA-jf87-cf79-32xgCGA-jjrr-v5h6-m74wCGA-jpj2-8rgm-6mc6CGA-jv9f-xh23-pc8hCGA-jx82-vf23-wqx2CGA-m37w-99h6-75w5CGA-m638-hp9f-mv8fCGA-m9pw-h647-mhwpCGA-mf9g-qx9f-rrq2CGA-mh69-w2xm-m4j7CGA-mj76-9wxx-83vqCGA-mrhx-94vj-vcvgCGA-mw34-r3qm-wgphCGA-mxw4-jm6q-93rcCGA-p348-jrcg-x4hfCGA-p5q8-493g-8g97CGA-p683-6pp2-63gfCGA-phjj-phw3-r42gCGA-pj7h-7gp7-xf37CGA-pjp5-26rm-6q8jCGA-ppch-2vmx-xg5wCGA-px56-rfj9-xhxqCGA-q88q-xcmx-cp33CGA-qr25-rmm5-rpv3CGA-r4ff-5mcf-6cm8CGA-rjpm-q3hw-7c49CGA-rv7v-ggv5-5ppvCGA-rxcw-cfvf-fjjhCGA-v8vq-r4rp-8783CGA-v8w4-8f7p-x9whCGA-v9qq-cxg3-63fgCGA-w69p-mgv6-qv6wCGA-w6rw-gm8j-84cvCGA-wgpm-vmgh-v2cwCGA-wpfx-279g-hx98CGA-wwx4-6wfm-c6v7CGA-x4mm-q5j6-x3fvCGA-x5xg-mw82-pmj5CGA-xm24-2px3-ffv4CGA-xrpx-wp5r-ffj5CGA-xx7c-vj4h-hqmfCGA-3cjc-fg94-q7h9CGA-3m2x-rpmm-77fxCGA-6xr4-wc5g-9r8cCGA-7fcf-q9v3-x7xpCGA-88wx-v4j9-vgmmCGA-8j8v-7cqv-fqcqCGA-9377-vx7v-2whpCGA-96jx-jm49-xx44CGA-9g22-vp8h-2wj7CGA-fm2x-6533-8p3hCGA-g49v-cjx4-g6m6CGA-hpj8-6jc5-pqjfCGA-m3xg-r8cf-j3m2CGA-pjfv-pgx4-8q54GHSA-9w38-p64v-xpmvCGA-q958-mjw6-8mfrCGA-v393-74w8-3rf9CGA-v7hm-m7fw-5ph3CGA-w775-3hhf-93w7CGA-x95c-xw44-6cpvCGA-xhmj-q48c-9xmr
Published 21-03-2024Last modified 13-02-2025
Some data may be incomplete
- 1 reference with an unsupported link type was hidden.
Vulnerability summary
CVE-2024-29133 is a medium (CVSS 5.4) Out-of-bounds Write vulnerability in apache software foundation apache commons configuration. EPSS estimates a 1.73% chance of exploitation in the next 30 days, higher than 77.2% of scored vulnerabilities.
CVSS score
5.4/10
010
Medium · v3.1 (CVE.org)EPSS score
1.73%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 3 · Related 8Timeline
- 21-03-2024PublishedVulnerability first disclosed.
- 13-02-2025Last modifiedVulnerability information updated.
Description
Out-of-bounds Write vulnerability in Apache Commons Configuration.This issue affects Apache Commons Configuration: from 2.0 before 2.10.1. Users are recommended to upgrade to version 2.10.1, which fixes the issue.
CVSS metrics
8 scores · 7 sources · 2 versionsMedium 6.9Preferred score · OSV · Maven (Ecosystem advisory) · calculated from vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:NSourcesSingle source
Medium 5.4Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:NSources7 sources · 5.4–6.5
- OSV · UbuntuEcosystem advisory · calculated5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- OSV · DebianEcosystem advisory · calculated5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- OSV · WolfiEcosystem advisory · calculated5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- OSV · ChainguardEcosystem advisory · calculated5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- OSV · MavenEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:LDiffers
- NVDNIST5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
EPSS trend
Probability
1.73%
Chance of exploitation in the next 30 days
Percentile
77%
Versus all other CVEs
30-day change
0.00 pp
From 1.73% on 19-09-2026
19-09-202619-10-2026
EPSS score1.73%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard70 products
- cassandra-reaper< 3.6.0-r0
- celeborn-0.5< 0.5.4-r26
- celeborn-0.6< 0.6.3-r7
- druid< 37.0.0-r56 | < 34.0.0-r6 | < 37.0.0-r14
- hadoop-client-modules< 3.3.6-r2
Wolfi63 products
- cassandra-reaper< 3.6.0-r0
- celeborn-0.6< 0.6.3-r7
- druid< 37.0.0-r56 | < 34.0.0-r6 | < 37.0.0-r14
- tez< 0.10.4-r6
- trino< 444-r1
Apache1 product
- commons_configuration≥ 2.0, < 2.10.1
Apache software foundation1 product
- apache commons configuration≥ 2.0, < 2.10.1
Debian1 product
- commons-configuration2All versions (No fix recorded) | < 2.10.1-1
Fedoraproject1 product
- fedoraEOL39 | 40
Org.apache.commons1 product
- commons-configuration2≥ 2.0, < 2.10.1
Ubuntu1 product
- commons-configuration2All versions (No fix recorded)
8 vendors · 139 products
