critical 9.8

CVE-2022-42889 in the critical feed json

Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults

published 2022-10-13 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-7022 , GHSA-599f-7c49-w659

cvss: 9.8; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 99.9%; EPSS 99.9% chance of exploitation in 30 days, percentile 99.9%
public exploits: 2; Metasploit, Exploit-DB

Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.StringLookup that performs the interpolation. Starting with version 1.5 and continuing through 1.9, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - "script" - execute expressions using the JVM script execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Text 1.10.0, which disables the problematic interpolators by default.

Patch / fix

fixed in 4 distros 3

maven org.apache.commons:commons-text 1.10.0
apache commons-text 1.10
apache commons_text 1.10
org.apache.commons commons-text 1.10

debian red hat opensuse

commons-text Debian 14, Debian 13, Debian 12 1.10.0-1

debian advisories DEBIAN-CVE-2022-42889

jenkins ocp tools 4.13 2.414.3.1698292201-3.el8
jenkins-2-plugins ocp tools 4.13 4.13.1698292274-1.el8
jenkins ocp tools 4.14 2.426.3.1706516352-3.el8
jenkins-2-plugins ocp tools 4.14 4.14.1706516441-1.el8
jenkins ocp tools 4.12 2.414.3.1698293911-3.el8
jenkins-2-plugins ocp tools 4.12 4.12.1698294000-1.el8
jenkins ocp tools 4.11 2.414.3.1698298955-3.el8
jenkins-2-plugins ocp tools 4.11 4.11.1698299029-1.el8

red hat advisories RHSA-2023:6179 RHSA-2025:1747 RHSA-2025:1746 RHSA-2024:0777 RHSA-2023:6172 RHSA-2023:6171

apache-commons-text openSUSE Tumbleweed 1.10.0-1.1

opensuse advisories openSUSE-SU-2024:12409-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-42889 updated 2026-11-04 cvss 9.8

apache-commons-text: variable interpolation RCE

Red Hat Integration Camel K 1 commons-text Red Hat Integration Camel Quarkus 1 commons-text
affected: workaround, no fix available
Red Hat JBoss Enterprise Application Platform 7 commons-text
affected: workaround, no fix planned “Will not fix”
Red Hat JBoss Enterprise Application Platform Expansion Pack commons-text
affected: workaround, no fix available
Red Hat OpenShift Container Platform 3.11 jenkins-2-plugins
affected: workaround, no fix planned “Out of support scope”
Red Hat OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8 jenkins-2-plugins 4.11.1683009941-1.el8, jenkins-2-plugins 4.11.1698299029-1.el8, jenkins-2-plugins 4.11.1706516946-1.el8
fixed: vendor fix RHSA-2023:3198
Red Hat OpenShift Developer Tools and Services for OCP 4.12 jenkins-2-plugins 4.12.1683009955-1.el8, jenkins-2-plugins 4.12.1698294000-1.el8, jenkins-2-plugins 4.12.1706515741-1.el8
fixed: vendor fix RHSA-2023:3195
Red Hat OpenShift Developer Tools and Services for OCP 4.13 jenkins-2-plugins 4.13.1684911916-1.el8, jenkins-2-plugins 4.13.1698292274-1.el8, jenkins-2-plugins 4.13.1706516346-1.el8
fixed: vendor fix RHSA-2023:3299
Red Hat OpenShift Developer Tools and Services for OCP 4.14 jenkins-2-plugins 4.14.1699356715-1.el8, jenkins-2-plugins 4.14.1706516441-1.el8
fixed: vendor fix RHSA-2023:7288

show 15 more

Red Hat AMQ Broker 7
fixed: vendor fix RHSA-2022:8876
Red Hat AMQ Streams 2.7.0
fixed: vendor fix RHSA-2024:3527
Red Hat build of Quarkus 2.7.7
fixed: vendor fix RHSA-2023:1006
Red Hat build of Quarkus 2.13.5
fixed: vendor fix RHSA-2022:9023
Red Hat Fuse 7.11.1
fixed: vendor fix RHSA-2022:8652
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-jettison 1.3.8-2.redhat_00002.1.ep7.el7, eap7-velocity 1.7.0-3.redhat_00006.1.ep7.el7, eap7-wildfly 7.1.9-2.GA_redhat_00002.1.ep7.el7, eap7-apache-cxf 3.1.16-4.redhat_00003.1.ep7.el7, eap7-netty 4.1.63-1.Final_redhat_00002.1.ep7.el7, eap7-apache-cxf-rt 3.1.16-4.redhat_00003.1.ep7.el7, +23 more
fixed: vendor fix RHSA-2025:1746
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-jettison 1.5.2-2.redhat_00002.1.el7eap, eap7-wildfly 7.3.12-3.GA_redhat_00002.1.el7eap, eap7-netty 4.1.63-4.Final_redhat_00002.1.el7eap, eap7-jackson-core 2.10.4-2.redhat_00004.1.el7eap, eap7-snakeyaml 1.33.0-1.SP1_redhat_00001.1.el7eap, eap7-resteasy 3.11.6-1.Final_redhat_00001.1.el7eap, +35 more
fixed: vendor fix RHSA-2025:1747
Red Hat OpenShift Container Platform 4.9 jenkins-2-plugins 4.9.1680069756-1.el8
fixed: vendor fix RHSA-2023:1524
Red Hat OpenShift Container Platform 4.10 jenkins-2-plugins 4.10.1680703106-1.el8
fixed: vendor fix RHSA-2023:1655
Red Hat Satellite 6.12 for RHEL 8 candlepin 4.1.18-1.el8sat, candlepin-selinux 4.1.18-1.el8sat
fixed: vendor fix RHSA-2023:0261
Red Hat Satellite 6.13 for RHEL 8 candlepin 4.2.13-1.el8sat, candlepin-selinux 4.2.13-1.el8sat
fixed: vendor fix RHSA-2023:2097
Red Hat RHINT Camel-Q 2.13.2
fixed: vendor fix RHSA-2023:0469
Red Hat RHINT Camel-Springboot 3.18.3
fixed: vendor fix RHSA-2022:8902
Red Hat RHPAM 7.13.1 async
fixed: vendor fix RHSA-2023:2135
Red Hat A-MQ Clients 2 commons-text Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/elasticsearch6-rhel8 Red Hat OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8 jenkins 2.387.1.1683009763-3.el8, jenkins 2.414.3.1698298955-3.el8, jenkins 2.426.3.1706516929-3.el8 Red Hat OpenShift Developer Tools and Services for OCP 4.12 jenkins 2.387.1.1683009767-3.el8, jenkins 2.414.3.1698293911-3.el8, jenkins 2.426.3.1706515686-3.el8 Red Hat OpenShift Developer Tools and Services for OCP 4.13 jenkins 2.387.3.1684911776-3.el8, jenkins 2.414.3.1698292201-3.el8, jenkins 2.426.3.1706516254-3.el8 Red Hat OpenShift Developer Tools and Services for OCP 4.14 jenkins 2.414.3.1699356615-3.el8, jenkins 2.426.3.1706516352-3.el8

+11 more productsfewer

Red Hat A-MQ Online commons-text Red Hat build of Apicurio Registry 2 commons-text Red Hat build of Debezium 1 commons-text Red Hat Data Grid 8 commons-text Red Hat JBoss Data Grid 7 commons-text Red Hat JBoss Enterprise Application Platform 6 commons-text Red Hat JBoss Web Server 5 commons-text Red Hat OpenShift Container Platform 4.9 perf 4.18.0-305.85.1.el8_4, kernel 4.18.0-305.85.1.el8_4, bpftool 4.18.0-305.85.1.el8_4, jenkins 2.361.4.1680068660-1.el8, kernel-core 4.18.0-305.85.1.el8_4, kernel-tools 4.18.0-305.85.1.el8_4, +39 more Red Hat OpenShift Container Platform 4.10 haproxy 2.2.19-4.el8, haproxy22 2.2.19-4.el8, perf 4.18.0-305.85.1.el8_4, kernel 4.18.0-305.85.1.el8_4, bpftool 4.18.0-305.85.1.el8_4, toolbox 0.0.9-1.rhaos4.10.el8, +46 more Red Hat Satellite 6.12 for RHEL 8 foreman 3.3.0.18-1.el8sat, satellite 6.12.1-1.el8sat, rubygem-rails 6.0.6-2.el8sat, foreman-cli 3.3.0.18-1.el8sat, foreman-ec2 3.3.0.18-1.el8sat, foreman-gce 3.3.0.18-1.el8sat, +35 more Red Hat Satellite 6.13 for RHEL 8 cjson 1.7.14-5.el8sat, katello 4.7.0-1.el8sat, libsolv 0.7.22-4.el8pc, libcomps 0.1.18-4.el8pc, python-idna 3.3-2.el8pc, python-pbr 5.8.0-4.el8pc, +669 more

not affected: vulnerable code not present

3 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

2022-10-13 Published
2022-10-13 First public exploit (Metasploit exploit/multi/http/apache_commons_text4shell)

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: total
Assessed: 2 y ago (2024-01-24)

Exploit prediction

99.93% chance of exploitation in the next 30 days, higher than 99.9% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

Metasploit exploit/multi/http/apache_commons_text4shell Apache Commons Text RCE metasploit exploit, excellent rank, 2022-10-13
EDB-52261 Apache Commons Text 1.10.0 - Remote Code Execution webapps, 2025-04-18

CVSS scores

assigned by	version	score	vector
GitHub	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
maven	org.apache.commons:commons-text	>=1.5, <1.10.0	1.10.0
maven	com.guicedee.services:commons-text	<=1.2.2.1-jre17	no fix listed

Affected products

Apache Software Foundation Apache Commons Text

Classification

Weakness

CWE-94 Improper Control of Generation of Code

References

security.gentoo.org /glsa/202301-05
vendor-advisory, web, third-party-advisory
lists.apache.org /thread/n2bd4vdsgkqh2tm14l1wyc3jyol7s1om
web, mailing-list, vendor-advisory
openwall.com /lists/oss-security/2022/10/13/4
mailing-list, web, third-party-advisory
openwall.com /lists/oss-security/2022/10/18/1
mailing-list, web, third-party-advisory
security.netapp.com /advisory/ntap-20221020-0004/
third-party-advisory
psirt.global.sonicwall.com /vuln-detail/SNWLID-2022-0022
web, third-party-advisory
seclists.org /fulldisclosure/2023/Feb/3
mailing-list, web, third-party-advisory
packetstormsecurity.com /files/171003/OX-App-Suite-Cross-Site-Scripting-Server-Side-Request-Forgery.html
web, third-party-advisory, vdb-entry
packetstormsecurity.com /files/176650/Apache-Commons-Text-1.9-Remote-Code-Execution.html
web
nvd.nist.gov /vuln/detail/CVE-2022-42889
advisory
arxiv.org /pdf/2306.05534
web
github.com /apache/commons-text
package
security.netapp.com /advisory/ntap-20221020-0004
web
securitylab.github.com /advisories/GHSL-2022-018_Apache_Commons_Text
advisory

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Add correct affected ranges per https://github.com/advisories/GHSA-599f-7c49-w659.

Summary