CVE-2014-0114

Name	CVE-2014-0114
Description	Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-57-1, DSA-2940-1
Debian Bugs	745897

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
commons-beanutils (PTS)	buster	1.9.3-1	fixed
	bookworm, bullseye	1.9.4-1	fixed
	trixie, sid	1.9.4-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
commons-beanutils	source	(unstable)	1.9.2-1	low
libstruts1.2-java	source	squeeze	1.2.9-4+deb6u1		DLA-57-1
libstruts1.2-java	source	wheezy	1.2.9-5+deb7u1		DSA-2940-1
libstruts1.2-java	source	(unstable)	1.2.9-9			745897

Notes

http://mail-archives.apache.org/mod_mbox/struts-announcements/201404.mbox/%3C535F5F52.4040108%40apache.org%3E
[wheezy] - commons-beanutils <no-dsa> (Too intrusive to backport; might break existing apps)
[squeeze] - commons-beanutils <no-dsa> (Too intrusive to backport; might break existing apps)
https://issues.apache.org/jira/browse/BEANUTILS-463