Read the docs
TI-2021-10139 Aliases CVE-2021-29425GHSA-gwrp-pvrq-jmwv

Possible limited path traversal vulnerabily in Apache Commons IO

Priority MEDIUM 48CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 15 fixed, 14 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat.

Summary

In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.10549 95th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial commons-io:commons-io (Maven): 2.7org.checkerframework.annotatedlib:commons-io (Maven): 2.7Red Hat: 15 advisoriesRed Hat: 15 fixed, 14 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Commons IOApache Commons IO 2.2; Apache Commons IO 2.3; Apache Commons IO 2.4; Apache Commons IO 2.5; Apache Commons IO 2.6—No fix listedCNA
—commons-io:commons-io (Maven)before 2.72.7Patch availableGHSA-gwrp-pvrq-jmwv
—com.cosium.vet:vet (Maven)1.0 – 3.22—No fix listedGHSA-gwrp-pvrq-jmwv
—com.diamondq.common:common-thirdparty.jcasbin (Maven)——No fix listedGHSA-gwrp-pvrq-jmwv
—com.liferay:com.liferay.sass.compiler.jsass (Maven)——No fix listedGHSA-gwrp-pvrq-jmwv
—com.virjar:ratel-api (Maven)1.0.0 – 1.3.6—No fix listedGHSA-gwrp-pvrq-jmwv
—net.hasor:cobble-lang (Maven)4.4.1 – 4.6.2—No fix listedGHSA-gwrp-pvrq-jmwv
—org.apache.commons:commons-io (Maven)——No fix listedGHSA-gwrp-pvrq-jmwv
—org.apache.servicemix.bundles:org.apache.servicemix.bundles.commons-io (Maven)1.4 – 1.5—No fix listedGHSA-gwrp-pvrq-jmwv
—org.checkerframework.annotatedlib:commons-io (Maven)2.6 to before 2.72.7Patch availableGHSA-gwrp-pvrq-jmwv
—org.smartboot.servlet:servlet-core (Maven)0.1.9 – 0.6—No fix listedGHSA-gwrp-pvrq-jmwv
  • Apache Commons IO VendorApache Affected Apache Commons IO 2.2; Apache Commons IO 2.3; Apache Commons IO 2.4; Apache Commons IO 2.5; Apache Commons IO 2.6 Fixed in — No fix listed CNA
  • commons-io:commons-io (Maven) Vendor— Affected before 2.7 Fixed in 2.7 Patch available GHSA-gwrp-pvrq-jmwv
  • com.cosium.vet:vet (Maven) Vendor— Affected 1.0 – 3.22 Fixed in — No fix listed GHSA-gwrp-pvrq-jmwv
  • com.diamondq.common:common-thirdparty.jcasbin (Maven) Vendor— Affected — Fixed in — No fix listed GHSA-gwrp-pvrq-jmwv
  • com.liferay:com.liferay.sass.compiler.jsass (Maven) Vendor— Affected — Fixed in — No fix listed GHSA-gwrp-pvrq-jmwv
  • com.virjar:ratel-api (Maven) Vendor— Affected 1.0.0 – 1.3.6 Fixed in — No fix listed GHSA-gwrp-pvrq-jmwv
  • net.hasor:cobble-lang (Maven) Vendor— Affected 4.4.1 – 4.6.2 Fixed in — No fix listed GHSA-gwrp-pvrq-jmwv
  • org.apache.commons:commons-io (Maven) Vendor— Affected — Fixed in — No fix listed GHSA-gwrp-pvrq-jmwv
  • org.apache.servicemix.bundles:org.apache.servicemix.bundles.commons-io (Maven) Vendor— Affected 1.4 – 1.5 Fixed in — No fix listed GHSA-gwrp-pvrq-jmwv
  • org.checkerframework.annotatedlib:commons-io (Maven) Vendor— Affected 2.6 to before 2.7 Fixed in 2.7 Patch available GHSA-gwrp-pvrq-jmwv
  • org.smartboot.servlet:servlet-core (Maven) Vendor— Affected 0.1.9 – 0.6 Fixed in — No fix listed GHSA-gwrp-pvrq-jmwv

CPE configurations NVD · 135

CPEVersionsRoleVendor
cpe:2.3:a:apache:commons_io:2.2:-:*:*:*:*:*:*2.2VulnerableApache
cpe:2.3:a:apache:commons_io:2.3:-:*:*:*:*:*:*2.3VulnerableApache
cpe:2.3:a:apache:commons_io:2.4:-:*:*:*:*:*:*2.4VulnerableApache
cpe:2.3:a:apache:commons_io:2.5:-:*:*:*:*:*:*2.5VulnerableApache
cpe:2.3:a:apache:commons_io:2.6:-:*:*:*:*:*:*2.6VulnerableApache
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:a:oracle:access_manager:11.1.2.3.0:*:*:*:*:*:*:*11.1.2.3.0VulnerableOracle
cpe:2.3:a:oracle:access_manager:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:access_manager:12.2.1.4.0:*:*:*:*:*:*:*12.2.1.4.0VulnerableOracle
cpe:2.3:a:oracle:agile_engineering_data_management:6.2.1.0:*:*:*:*:*:*:*6.2.1.0VulnerableOracle
  • cpe:2.3:a:apache:commons_io:2.2:-:*:*:*:*:*:* Versions 2.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:commons_io:2.3:-:*:*:*:*:*:* Versions 2.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:commons_io:2.4:-:*:*:*:*:*:* Versions 2.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:commons_io:2.5:-:*:*:*:*:*:* Versions 2.5 Vulnerable ·Apache
  • cpe:2.3:a:apache:commons_io:2.6:-:*:*:*:*:*:* Versions 2.6 Vulnerable ·Apache
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:a:oracle:access_manager:11.1.2.3.0:*:*:*:*:*:*:* Versions 11.1.2.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:access_manager:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:access_manager:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:agile_engineering_data_management:6.2.1.0:*:*:*:*:*:*:* Versions 6.2.1.0 Vulnerable ·Oracle
Show 125 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:*9.3.6VulnerableOracle
cpe:2.3:a:oracle:application_performance_management:13.4.1.0:*:*:*:*:*:*:*13.4.1.0VulnerableOracle
cpe:2.3:a:oracle:application_performance_management:13.5.1.0:*:*:*:*:*:*:*13.5.1.0VulnerableOracle
cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:*13.3.0.1VulnerableOracle
cpe:2.3:a:oracle:banking_apis:18.1:*:*:*:*:*:*:*18.1VulnerableOracle
cpe:2.3:a:oracle:banking_apis:18.2:*:*:*:*:*:*:*18.2VulnerableOracle
cpe:2.3:a:oracle:banking_apis:18.3:*:*:*:*:*:*:*18.3VulnerableOracle
cpe:2.3:a:oracle:banking_apis:19.1:*:*:*:*:*:*:*19.1VulnerableOracle
cpe:2.3:a:oracle:banking_apis:19.2:*:*:*:*:*:*:*19.2VulnerableOracle
cpe:2.3:a:oracle:banking_apis:20.1:*:*:*:*:*:*:*20.1VulnerableOracle
cpe:2.3:a:oracle:banking_apis:21.1:*:*:*:*:*:*:*21.1VulnerableOracle
cpe:2.3:a:oracle:banking_digital_experience:17.2:*:*:*:*:*:*:*17.2VulnerableOracle
cpe:2.3:a:oracle:banking_digital_experience:18.1:*:*:*:*:*:*:*18.1VulnerableOracle
cpe:2.3:a:oracle:banking_digital_experience:18.3:*:*:*:*:*:*:*18.3VulnerableOracle
cpe:2.3:a:oracle:banking_digital_experience:19.1:*:*:*:*:*:*:*19.1VulnerableOracle
cpe:2.3:a:oracle:banking_digital_experience:19.2:*:*:*:*:*:*:*19.2VulnerableOracle
cpe:2.3:a:oracle:banking_digital_experience:20.1:*:*:*:*:*:*:*20.1VulnerableOracle
cpe:2.3:a:oracle:banking_digital_experience:21.1:*:*:*:*:*:*:*21.1VulnerableOracle
cpe:2.3:a:oracle:banking_enterprise_default_management:2.6.2:*:*:*:*:*:*:*2.6.2VulnerableOracle
cpe:2.3:a:oracle:banking_enterprise_default_management:2.7.0:*:*:*:*:*:*:*2.7.0VulnerableOracle
cpe:2.3:a:oracle:banking_enterprise_default_management:2.7.1:*:*:*:*:*:*:*2.7.1VulnerableOracle
cpe:2.3:a:oracle:banking_enterprise_default_management:2.10.0:*:*:*:*:*:*:*2.10.0VulnerableOracle
cpe:2.3:a:oracle:banking_enterprise_default_management:2.12.0:*:*:*:*:*:*:*2.12.0VulnerableOracle
cpe:2.3:a:oracle:banking_enterprise_default_managment:*:*:*:*:*:*:*:*2.3.0 – 2.4.0VulnerableOracle
cpe:2.3:a:oracle:banking_party_management:2.7.0:*:*:*:*:*:*:*2.7.0VulnerableOracle
cpe:2.3:a:oracle:banking_platform:*:*:*:*:*:*:*:*2.3.0 – 2.4.1VulnerableOracle
cpe:2.3:a:oracle:banking_platform:2.6.2:*:*:*:*:*:*:*2.6.2VulnerableOracle
cpe:2.3:a:oracle:banking_platform:2.7.0:*:*:*:*:*:*:*2.7.0VulnerableOracle
cpe:2.3:a:oracle:banking_platform:2.7.1:*:*:*:*:*:*:*2.7.1VulnerableOracle
cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:*before 21.1.2VulnerableOracle
cpe:2.3:a:oracle:commerce_guided_search:11.3.2:*:*:*:*:*:*:*11.3.2VulnerableOracle
cpe:2.3:a:oracle:communications_application_session_controller:3.9.0:*:*:*:*:*:*:*3.9.0VulnerableOracle
cpe:2.3:a:oracle:communications_billing_and_revenue_management_elastic_charging_engine:11.3:*:*:*:*:*:*:*11.3VulnerableOracle
cpe:2.3:a:oracle:communications_billing_and_revenue_management_elastic_charging_engine:12.0:*:*:*:*:*:*:*12.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.14.0:*:*:*:*:*:*:*1.14.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:*1.14.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:1.4.0:*:*:*:*:*:*:*1.4.0VulnerableOracle
cpe:2.3:a:oracle:communications_contacts_server:8.0.0.6.0:*:*:*:*:*:*:*8.0.0.6.0VulnerableOracle
cpe:2.3:a:oracle:communications_converged_application_server_-_service_controller:6.2:*:*:*:*:*:*:*6.2VulnerableOracle
cpe:2.3:a:oracle:communications_convergence:3.0.2.2.0:*:*:*:*:*:*:*3.0.2.2.0VulnerableOracle
cpe:2.3:a:oracle:communications_design_studio:*:*:*:*:*:*:*:*7.4.0 – 7.4.2VulnerableOracle
cpe:2.3:a:oracle:communications_design_studio:7.3.5:*:*:*:*:*:*:*7.3.5VulnerableOracle
cpe:2.3:a:oracle:communications_diameter_intelligence_hub:*:*:*:*:*:*:*:*8.0.0 – 8.1.0; 8.2.0 – 8.2.3VulnerableOracle
cpe:2.3:a:oracle:communications_interactive_session_recorder:6.3:*:*:*:*:*:*:*6.3VulnerableOracle
cpe:2.3:a:oracle:communications_interactive_session_recorder:6.4:*:*:*:*:*:*:*6.4VulnerableOracle
cpe:2.3:a:oracle:communications_offline_mediation_controller:12.0.0.3:*:*:*:*:*:*:*12.0.0.3VulnerableOracle
cpe:2.3:a:oracle:communications_order_and_service_management:7.3:*:*:*:*:*:*:*7.3VulnerableOracle
cpe:2.3:a:oracle:communications_order_and_service_management:7.4:*:*:*:*:*:*:*7.4VulnerableOracle
cpe:2.3:a:oracle:communications_policy_management:12.5.0.0.0:*:*:*:*:*:*:*12.5.0.0.0VulnerableOracle
cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0.4.0:*:*:*:*:*:*:*12.0.0.4.0VulnerableOracle
cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0.5.0:*:*:*:*:*:*:*12.0.0.5.0VulnerableOracle
cpe:2.3:a:oracle:communications_service_broker:6.2:*:*:*:*:*:*:*6.2VulnerableOracle
cpe:2.3:a:oracle:enterprise_communications_broker:3.3:*:*:*:*:*:*:*3.3VulnerableOracle
cpe:2.3:a:oracle:enterprise_session_border_controller:8.4:*:*:*:*:*:*:*8.4VulnerableOracle
cpe:2.3:a:oracle:enterprise_session_border_controller:9.0:*:*:*:*:*:*:*9.0VulnerableOracle
cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:*8.0.7 – 8.1.1VulnerableOracle
cpe:2.3:a:oracle:financial_services_model_management_and_governance:*:*:*:*:*:*:*:*8.0.8 – 8.1.1VulnerableOracle
cpe:2.3:a:oracle:flexcube_core_banking:*:*:*:*:*:*:*:*11.6.0 – 11.8.0VulnerableOracle
cpe:2.3:a:oracle:flexcube_core_banking:5.2.0:*:*:*:*:*:*:*5.2.0VulnerableOracle
cpe:2.3:a:oracle:flexcube_core_banking:11.10.0:*:*:*:*:*:*:*11.10.0VulnerableOracle
cpe:2.3:a:oracle:fusion_middleware_mapviewer:12.2.1.4.0:*:*:*:*:*:*:*12.2.1.4.0VulnerableOracle
cpe:2.3:a:oracle:health_sciences_data_management_workbench:2.5.2.1:*:*:*:*:*:*:*2.5.2.1VulnerableOracle
cpe:2.3:a:oracle:health_sciences_data_management_workbench:3.0.0.0:*:*:*:*:*:*:*3.0.0.0VulnerableOracle
cpe:2.3:a:oracle:health_sciences_information_manager:*:*:*:*:*:*:*:*3.0.1 – 3.0.4VulnerableOracle
cpe:2.3:a:oracle:healthcare_data_repository:8.1.0:*:*:*:*:*:*:*8.1.0VulnerableOracle
cpe:2.3:a:oracle:helidon:1.4.7:*:*:*:*:*:*:*1.4.7VulnerableOracle
cpe:2.3:a:oracle:helidon:2.2.0:*:*:*:*:*:*:*2.2.0VulnerableOracle
cpe:2.3:a:oracle:insurance_policy_administration:11.0.2:*:*:*:*:*:*:*11.0.2VulnerableOracle
cpe:2.3:a:oracle:insurance_policy_administration:11.1.0:*:*:*:*:*:*:*11.1.0VulnerableOracle
cpe:2.3:a:oracle:insurance_policy_administration:11.2.8:*:*:*:*:*:*:*11.2.8VulnerableOracle
cpe:2.3:a:oracle:insurance_policy_administration:11.3.0:*:*:*:*:*:*:*11.3.0VulnerableOracle
cpe:2.3:a:oracle:insurance_policy_administration:11.3.1:*:*:*:*:*:*:*11.3.1VulnerableOracle
cpe:2.3:a:oracle:insurance_rules_palette:11.0.2:*:*:*:*:*:*:*11.0.2VulnerableOracle
cpe:2.3:a:oracle:insurance_rules_palette:11.1.0:*:*:*:*:*:*:*11.1.0VulnerableOracle
cpe:2.3:a:oracle:insurance_rules_palette:11.2.8:*:*:*:*:*:*:*11.2.8VulnerableOracle
cpe:2.3:a:oracle:insurance_rules_palette:11.3.0:*:*:*:*:*:*:*11.3.0VulnerableOracle
cpe:2.3:a:oracle:insurance_rules_palette:11.3.1:*:*:*:*:*:*:*11.3.1VulnerableOracle
cpe:2.3:a:oracle:oss_support_tools:*:*:*:*:*:*:*:*before 2.12.42VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*17.7 – 17.12VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:*18.8VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:*19.12VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:*20.12VulnerableOracle
cpe:2.3:a:oracle:primavera_unifier:21.12:*:*:*:*:*:*:*21.12VulnerableOracle
cpe:2.3:a:oracle:real_user_experience_insight:13.4.1.0:*:*:*:*:*:*:*13.4.1.0VulnerableOracle
cpe:2.3:a:oracle:real_user_experience_insight:13.5.1.0:*:*:*:*:*:*:*13.5.1.0VulnerableOracle
cpe:2.3:a:oracle:rest_data_services:*:*:*:*:-:*:*:*before 21.2VulnerableOracle
cpe:2.3:a:oracle:rest_data_services:21.3:*:*:*:-:*:*:*21.3VulnerableOracle
cpe:2.3:a:oracle:retail_assortment_planning:16.0.3:*:*:*:*:*:*:*16.0.3VulnerableOracle
cpe:2.3:a:oracle:retail_integration_bus:*:*:*:*:*:*:*:*16.0.1 – 16.0.3VulnerableOracle
cpe:2.3:a:oracle:retail_integration_bus:13.0:*:*:*:*:*:*:*13.0VulnerableOracle
cpe:2.3:a:oracle:retail_integration_bus:14.1.3.0:*:*:*:*:*:*:*14.1.3.0VulnerableOracle
cpe:2.3:a:oracle:retail_integration_bus:14.1.3.2:*:*:*:*:*:*:*14.1.3.2VulnerableOracle
cpe:2.3:a:oracle:retail_integration_bus:15.0.3.1:*:*:*:*:*:*:*15.0.3.1VulnerableOracle
cpe:2.3:a:oracle:retail_integration_bus:19.0.0:*:*:*:*:*:*:*19.0.0VulnerableOracle
cpe:2.3:a:oracle:retail_integration_bus:19.0.1:*:*:*:*:*:*:*19.0.1VulnerableOracle
cpe:2.3:a:oracle:retail_merchandising_system:16.0.3:*:*:*:*:*:*:*16.0.3VulnerableOracle
cpe:2.3:a:oracle:retail_merchandising_system:19.0.1:*:*:*:*:*:*:*19.0.1VulnerableOracle
cpe:2.3:a:oracle:retail_order_broker:16.0:*:*:*:*:*:*:*16.0VulnerableOracle
cpe:2.3:a:oracle:retail_order_broker:18.0:*:*:*:*:*:*:*18.0VulnerableOracle
cpe:2.3:a:oracle:retail_order_broker:19.1:*:*:*:*:*:*:*19.1VulnerableOracle
cpe:2.3:a:oracle:retail_pricing:19.0.1:*:*:*:*:*:*:*19.0.1VulnerableOracle
cpe:2.3:a:oracle:retail_service_backbone:*:*:*:*:*:*:*:*16.0.1 – 16.0.3VulnerableOracle
cpe:2.3:a:oracle:retail_service_backbone:14.1.3.0:*:*:*:*:*:*:*14.1.3.0VulnerableOracle
cpe:2.3:a:oracle:retail_service_backbone:14.1.3.2:*:*:*:*:*:*:*14.1.3.2VulnerableOracle
cpe:2.3:a:oracle:retail_service_backbone:15.0.3.1:*:*:*:*:*:*:*15.0.3.1VulnerableOracle
cpe:2.3:a:oracle:retail_service_backbone:19.0.0:*:*:*:*:*:*:*19.0.0VulnerableOracle
cpe:2.3:a:oracle:retail_service_backbone:19.0.1:*:*:*:*:*:*:*19.0.1VulnerableOracle
cpe:2.3:a:oracle:retail_size_profile_optimization:16.0.3:*:*:*:*:*:*:*16.0.3VulnerableOracle
cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.4:*:*:*:*:*:*:*17.0.4VulnerableOracle
cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:*:*:*:*:*:*:*18.0.3VulnerableOracle
cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.2:*:*:*:*:*:*:*19.0.2VulnerableOracle
cpe:2.3:a:oracle:retail_xstore_point_of_service:20.0.1:*:*:*:*:*:*:*20.0.1VulnerableOracle
cpe:2.3:a:oracle:solaris_cluster:4.0:*:*:*:*:*:*:*4.0VulnerableOracle
cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.1.1:*:*:*:*:*:*:*6.0.0.1.1VulnerableOracle
cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.2.2:*:*:*:*:*:*:*6.0.0.2.2VulnerableOracle
cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.3.1:*:*:*:*:*:*:*6.0.0.3.1VulnerableOracle
cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*12.2.1.4.0VulnerableOracle
cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:*12.1.3.0.0VulnerableOracle
cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*12.2.1.4.0VulnerableOracle
cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*14.1.1.0.0VulnerableOracle
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*not specified by NVDVulnerableNetApp
  • cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:* Versions 9.3.6 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:application_performance_management:13.4.1.0:*:*:*:*:*:*:* Versions 13.4.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:application_performance_management:13.5.1.0:*:*:*:*:*:*:* Versions 13.5.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:* Versions 13.3.0.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_apis:18.1:*:*:*:*:*:*:* Versions 18.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_apis:18.2:*:*:*:*:*:*:* Versions 18.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_apis:18.3:*:*:*:*:*:*:* Versions 18.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_apis:19.1:*:*:*:*:*:*:* Versions 19.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_apis:19.2:*:*:*:*:*:*:* Versions 19.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_apis:20.1:*:*:*:*:*:*:* Versions 20.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_apis:21.1:*:*:*:*:*:*:* Versions 21.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_digital_experience:17.2:*:*:*:*:*:*:* Versions 17.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_digital_experience:18.1:*:*:*:*:*:*:* Versions 18.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_digital_experience:18.3:*:*:*:*:*:*:* Versions 18.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_digital_experience:19.1:*:*:*:*:*:*:* Versions 19.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_digital_experience:19.2:*:*:*:*:*:*:* Versions 19.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_digital_experience:20.1:*:*:*:*:*:*:* Versions 20.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_digital_experience:21.1:*:*:*:*:*:*:* Versions 21.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_enterprise_default_management:2.6.2:*:*:*:*:*:*:* Versions 2.6.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_enterprise_default_management:2.7.0:*:*:*:*:*:*:* Versions 2.7.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_enterprise_default_management:2.7.1:*:*:*:*:*:*:* Versions 2.7.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_enterprise_default_management:2.10.0:*:*:*:*:*:*:* Versions 2.10.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_enterprise_default_management:2.12.0:*:*:*:*:*:*:* Versions 2.12.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_enterprise_default_managment:*:*:*:*:*:*:*:* Versions 2.3.0 – 2.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_party_management:2.7.0:*:*:*:*:*:*:* Versions 2.7.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_platform:*:*:*:*:*:*:*:* Versions 2.3.0 – 2.4.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_platform:2.6.2:*:*:*:*:*:*:* Versions 2.6.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_platform:2.7.0:*:*:*:*:*:*:* Versions 2.7.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_platform:2.7.1:*:*:*:*:*:*:* Versions 2.7.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:* Versions before 21.1.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:commerce_guided_search:11.3.2:*:*:*:*:*:*:* Versions 11.3.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_application_session_controller:3.9.0:*:*:*:*:*:*:* Versions 3.9.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_billing_and_revenue_management_elastic_charging_engine:11.3:*:*:*:*:*:*:* Versions 11.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_billing_and_revenue_management_elastic_charging_engine:12.0:*:*:*:*:*:*:* Versions 12.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.14.0:*:*:*:*:*:*:* Versions 1.14.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:* Versions 1.14.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:1.4.0:*:*:*:*:*:*:* Versions 1.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_contacts_server:8.0.0.6.0:*:*:*:*:*:*:* Versions 8.0.0.6.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_converged_application_server_-_service_controller:6.2:*:*:*:*:*:*:* Versions 6.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_convergence:3.0.2.2.0:*:*:*:*:*:*:* Versions 3.0.2.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_design_studio:*:*:*:*:*:*:*:* Versions 7.4.0 – 7.4.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_design_studio:7.3.5:*:*:*:*:*:*:* Versions 7.3.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_diameter_intelligence_hub:*:*:*:*:*:*:*:* Versions 8.0.0 – 8.1.0; 8.2.0 – 8.2.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_interactive_session_recorder:6.3:*:*:*:*:*:*:* Versions 6.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_interactive_session_recorder:6.4:*:*:*:*:*:*:* Versions 6.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_offline_mediation_controller:12.0.0.3:*:*:*:*:*:*:* Versions 12.0.0.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_order_and_service_management:7.3:*:*:*:*:*:*:* Versions 7.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_order_and_service_management:7.4:*:*:*:*:*:*:* Versions 7.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_policy_management:12.5.0.0.0:*:*:*:*:*:*:* Versions 12.5.0.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0.4.0:*:*:*:*:*:*:* Versions 12.0.0.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0.5.0:*:*:*:*:*:*:* Versions 12.0.0.5.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_service_broker:6.2:*:*:*:*:*:*:* Versions 6.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:enterprise_communications_broker:3.3:*:*:*:*:*:*:* Versions 3.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:enterprise_session_border_controller:8.4:*:*:*:*:*:*:* Versions 8.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:enterprise_session_border_controller:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:* Versions 8.0.7 – 8.1.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_model_management_and_governance:*:*:*:*:*:*:*:* Versions 8.0.8 – 8.1.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:flexcube_core_banking:*:*:*:*:*:*:*:* Versions 11.6.0 – 11.8.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:flexcube_core_banking:5.2.0:*:*:*:*:*:*:* Versions 5.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:flexcube_core_banking:11.10.0:*:*:*:*:*:*:* Versions 11.10.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:fusion_middleware_mapviewer:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:health_sciences_data_management_workbench:2.5.2.1:*:*:*:*:*:*:* Versions 2.5.2.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:health_sciences_data_management_workbench:3.0.0.0:*:*:*:*:*:*:* Versions 3.0.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:health_sciences_information_manager:*:*:*:*:*:*:*:* Versions 3.0.1 – 3.0.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:healthcare_data_repository:8.1.0:*:*:*:*:*:*:* Versions 8.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:helidon:1.4.7:*:*:*:*:*:*:* Versions 1.4.7 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:helidon:2.2.0:*:*:*:*:*:*:* Versions 2.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:insurance_policy_administration:11.0.2:*:*:*:*:*:*:* Versions 11.0.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:insurance_policy_administration:11.1.0:*:*:*:*:*:*:* Versions 11.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:insurance_policy_administration:11.2.8:*:*:*:*:*:*:* Versions 11.2.8 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:insurance_policy_administration:11.3.0:*:*:*:*:*:*:* Versions 11.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:insurance_policy_administration:11.3.1:*:*:*:*:*:*:* Versions 11.3.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:insurance_rules_palette:11.0.2:*:*:*:*:*:*:* Versions 11.0.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:insurance_rules_palette:11.1.0:*:*:*:*:*:*:* Versions 11.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:insurance_rules_palette:11.2.8:*:*:*:*:*:*:* Versions 11.2.8 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:insurance_rules_palette:11.3.0:*:*:*:*:*:*:* Versions 11.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:insurance_rules_palette:11.3.1:*:*:*:*:*:*:* Versions 11.3.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:oss_support_tools:*:*:*:*:*:*:*:* Versions before 2.12.42 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:* Versions 17.7 – 17.12 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:* Versions 18.8 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:* Versions 19.12 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:* Versions 20.12 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_unifier:21.12:*:*:*:*:*:*:* Versions 21.12 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:real_user_experience_insight:13.4.1.0:*:*:*:*:*:*:* Versions 13.4.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:real_user_experience_insight:13.5.1.0:*:*:*:*:*:*:* Versions 13.5.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:rest_data_services:*:*:*:*:-:*:*:* Versions before 21.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:rest_data_services:21.3:*:*:*:-:*:*:* Versions 21.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_assortment_planning:16.0.3:*:*:*:*:*:*:* Versions 16.0.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_integration_bus:*:*:*:*:*:*:*:* Versions 16.0.1 – 16.0.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_integration_bus:13.0:*:*:*:*:*:*:* Versions 13.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_integration_bus:14.1.3.0:*:*:*:*:*:*:* Versions 14.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_integration_bus:14.1.3.2:*:*:*:*:*:*:* Versions 14.1.3.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_integration_bus:15.0.3.1:*:*:*:*:*:*:* Versions 15.0.3.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_integration_bus:19.0.0:*:*:*:*:*:*:* Versions 19.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_integration_bus:19.0.1:*:*:*:*:*:*:* Versions 19.0.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_merchandising_system:16.0.3:*:*:*:*:*:*:* Versions 16.0.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_merchandising_system:19.0.1:*:*:*:*:*:*:* Versions 19.0.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_order_broker:16.0:*:*:*:*:*:*:* Versions 16.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_order_broker:18.0:*:*:*:*:*:*:* Versions 18.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_order_broker:19.1:*:*:*:*:*:*:* Versions 19.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_pricing:19.0.1:*:*:*:*:*:*:* Versions 19.0.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_service_backbone:*:*:*:*:*:*:*:* Versions 16.0.1 – 16.0.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_service_backbone:14.1.3.0:*:*:*:*:*:*:* Versions 14.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_service_backbone:14.1.3.2:*:*:*:*:*:*:* Versions 14.1.3.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_service_backbone:15.0.3.1:*:*:*:*:*:*:* Versions 15.0.3.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_service_backbone:19.0.0:*:*:*:*:*:*:* Versions 19.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_service_backbone:19.0.1:*:*:*:*:*:*:* Versions 19.0.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_size_profile_optimization:16.0.3:*:*:*:*:*:*:* Versions 16.0.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.4:*:*:*:*:*:*:* Versions 17.0.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:*:*:*:*:*:*:* Versions 18.0.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.2:*:*:*:*:*:*:* Versions 19.0.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_xstore_point_of_service:20.0.1:*:*:*:*:*:*:* Versions 20.0.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:solaris_cluster:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.1.1:*:*:*:*:*:*:* Versions 6.0.0.1.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.2.2:*:*:*:*:*:*:* Versions 6.0.0.2.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.3.1:*:*:*:*:*:*:* Versions 6.0.0.3.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:* Versions 12.1.3.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:* Versions 14.1.1.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* Versions not specified by NVD Vulnerable ·NetApp

Remediation

  • Fix · GHSA-gwrp-pvrq-jmwv commons-io:commons-io (Maven) Fixed in 2.7 Advisory →
  • Fix · GHSA-gwrp-pvrq-jmwv org.checkerframework.annotatedlib:commons-io (Maven) Fixed in 2.7 Advisory →

Red Hat 15 advisories

  • RHSA-2022:1110 Released 2022-03-29 · Red Hat rating Moderate
    Red Hat Decision Manager 7.12.1 security update
    • RHDM 7.12.1
  • RHSA-2022:1108 Released 2022-03-29 · Red Hat rating Moderate
    Red Hat Process Automation Manager 7.12.1 security update
    • RHPAM 7.12.1
  • RHSA-2021:5134 Released 2021-12-14 · Red Hat rating Critical
    Red Hat Fuse 7.10.0 release and security update
    • Red Hat Fuse 7.10
Show 12 more Red Hat advisories
  • RHSA-2021:3700 Released 2021-09-30 · Red Hat rating Moderate
    Red Hat AMQ Broker 7.9.0 release and security update
    • Red Hat AMQ 7.9.0
  • RHSA-2021:3660 Released 2021-09-23 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.1 security update
    • Red Hat JBoss Enterprise Application Platform commons-io.commons-io-2.10.0.redhat-00001.jar, io.netty.netty-all-4.1.63.Final-redhat-00001.jar, io.undertow.undertow-core-2.2.9.SP1-redhat-00001.jar +5
  • RHSA-2021:3658 Released 2021-09-23 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.1 security update on RHEL 8
    • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-apache-commons-io-2.10.0-1.redhat_00001.1.el8eap, eap7-jakarta-el-3.0.3-2.redhat_00006.1.el8eap, eap7-netty-4.1.63-1.Final_redhat_00001.1.el8eap +9
  • RHSA-2021:3656 Released 2021-09-23 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.1 security update on RHEL 7
    • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-apache-commons-io-2.10.0-1.redhat_00001.1.el7eap, eap7-jakarta-el-3.0.3-2.redhat_00006.1.el7eap, eap7-netty-4.1.63-1.Final_redhat_00001.1.el7eap +11
  • RHSA-2021:3534 Released 2021-09-14 · Red Hat rating Moderate
    Red Hat Single Sign-On 7.4.9 security update
    • Red Hat Single Sign-On 7.4.9
  • RHSA-2021:3516 Released 2021-09-13 · Red Hat rating Important
    EAP XP 2 security update to CVE fixes in the EAP 7.3.x base
    • Red Hat EAP-XP 2.0.0 via EAP 7.3.x base
  • RHSA-2021:3468 Released 2021-09-08 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.9 security update on RHEL 8
    • Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-apache-commons-io-2.10.0-1.redhat_00001.1.el8eap, eap7-hal-console-3.2.16-1.Final_redhat_00001.1.el8eap, eap7-hibernate-5.3.20-4.SP2_redhat_00001.1.el8eap +47
  • RHSA-2021:3467 Released 2021-09-08 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.9 security update on RHEL 7
    • Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-apache-commons-io-2.10.0-1.redhat_00001.1.el7eap, eap7-hal-console-3.2.16-1.Final_redhat_00001.1.el7eap, eap7-hibernate-5.3.20-4.SP2_redhat_00001.1.el7eap +47
  • RHSA-2021:3466 Released 2021-09-08 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.9 security update on RHEL 6
    • Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-apache-commons-io-2.10.0-1.redhat_00001.1.el6eap, eap7-hal-console-3.2.16-1.Final_redhat_00001.1.el6eap, eap7-hibernate-5.3.20-4.SP2_redhat_00001.1.el6eap +47
  • RHSA-2021:3471 Released 2021-09-08 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.9 security update
    • EAP 7.3.9 release
  • RHSA-2021:3225 Released 2021-08-19 · Red Hat rating Moderate
    Red Hat AMQ Streams 1.8.0 release and security update
    • Red Hat AMQ Streams 1.8.0
  • RHSA-2021:2465 Released 2021-07-07 · Red Hat rating Moderate
    Red Hat build of Eclipse Vert.x 4.1.0 security update
    • Vert.x 4.1.0

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
A-MQ Clients 2AffectedNo fix planned: Will not fix
Red Hat BPM Suite 6AffectedNo fix planned: Out of support scope
Red Hat Data Grid 8AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat JBoss A-MQ 6AffectedNo fix planned: Out of support scope
Red Hat JBoss BRMS 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Grid 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Virtualization 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform Expansion PackAffectedNo fix yet
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Out of support scope
Red Hat OpenShift Application RuntimesAffectedNo fix planned: Will not fix
Red Hat Software CollectionsAffectedNo fix planned: Will not fix
EAP 7.3.9 releaseFixed RHSA-2021:3471
RHDM 7.12.1Fixed RHSA-2022:1110
RHPAM 7.12.1Fixed RHSA-2022:1108
Red Hat AMQ 7.9.0Fixed RHSA-2021:3700
Red Hat AMQ Streams 1.8.0Fixed RHSA-2021:3225
Red Hat EAP-XP 2.0.0 via EAP 7.3.x baseFixed RHSA-2021:3516
Red Hat Fuse 7.10Fixed RHSA-2021:5134
Red Hat JBoss EAP 7.3 for BaseOS-8Fixed RHSA-2021:3468
Red Hat JBoss EAP 7.3 for RHEL 6 ServerFixed RHSA-2021:3466
Red Hat JBoss EAP 7.3 for RHEL 7 ServerFixed RHSA-2021:3467
Red Hat JBoss EAP 7.4 for RHEL 7 ServerFixed RHSA-2021:3656
Red Hat JBoss EAP 7.4 for RHEL 8Fixed RHSA-2021:3658
Red Hat JBoss Enterprise Application Platform Fixed RHSA-2021:3660
Red Hat Single Sign-On 7.4.9Fixed RHSA-2021:3534
Vert.x 4.1.0Fixed RHSA-2021:2465
Not affected: 7 products
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server
  • Red Hat JBoss EAP 7.4 for RHEL 8
  • Red Hat JBoss Enterprise Application Platform
  • Red Hat JBoss Operations Network 3
  • Red Hat build of Quarkus

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-29425
  2. 2026-10-03 Alias added: GHSA-gwrp-pvrq-jmwv
  3. 2026-10-07 CVSS score added · CISA ADP
  4. 2026-10-07 CISA SSVC decision points changed
  5. 2026-10-07 Priority changed: LOW → MEDIUM

References

Exploit 1

Patch 3

Advisory 5

Other 81

  • TI-2024-31841 Apache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReader CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences