Ubuntu alert USN-8322-1 (commons-beanutils)

From:
             
 
noreply+usn-bot@canonical.com
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-8322-1] Apache Commons BeanUtils vulnerability
Date:
             
 
Wed, 27 May 2026 16:48:02 +0000
Message-ID:
             
 
<E1wSHQI-0005yg-QN@lists.ubuntu.com>
==========================================================================
Ubuntu Security Notice USN-8322-1
May 27, 2026

commons-beanutils vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS

Summary:

Apache Commons BeanUtils could be made to run programs if it received
specially crafted input.

Software Description:
- commons-beanutils: Apache Commons BeanUtils - Utility for manipulating Java beans

Details:

It was discovered that Apache Commons BeanUtils incorrectly allowed
access to the declaredClass property of Java enum objects when handling
externally supplied property paths. An attacker could possibly use this
issue to execute arbitrary code.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 24.04 LTS
  libcommons-beanutils-java       1.9.4-2ubuntu0.1~esm1
                                  Available with Ubuntu Pro

Ubuntu 22.04 LTS
  libcommons-beanutils-java       1.9.4-1+deb11u1build0.22.04.1

Ubuntu 20.04 LTS
  libcommons-beanutils-java       1.9.4-1ubuntu0.20.04.1~esm1
                                  Available with Ubuntu Pro

Ubuntu 18.04 LTS
  libcommons-beanutils-java       1.9.3-1ubuntu0.1~esm2
                                  Available with Ubuntu Pro

Ubuntu 16.04 LTS
  libcommons-beanutils-java       1.9.2-3ubuntu0.1~esm1
                                  Available with Ubuntu Pro

Ubuntu 14.04 LTS
  libcommons-beanutils-java       1.9.1-1ubuntu0.1~esm2
                                  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-8322-1
  CVE-2025-48734

Package Information:
  https://launchpad.net/ubuntu/+source/commons-beanutils/1....


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmoXH9wACgkQcpJm3tlz
hgGwShAA0hJ59gqfLFmsvP67oJxXc9AtIVDnIlrYBxupb+n1LHeLa6+aJo6GuCRm
C+UCFApwxCIoThHTuamyY/sES952p+Oi15KA4J7tGSLLZ0sw8pGkaGWtc8Nvmtu9
OH3wHD6+GRGRCkkqhjg4xzg83WWJpwqc8Es755aru6vHvMSAlsgXC9V1aor5lQax
HWhvaLNz9Gw/Q4iAc2OwI7e2vLdRo3NDh3FDb9/lilz1O7W5on8PAIY86TCNuMiK
2aMvzOCfautuv8/1JoZmB4Uzd/hYbYM9rcW+P9cx54yYMecPptqkKFjf3VqpRSu7
5jlVos97FvOOnTIM/YvErf9SRFBbqWSxS08SqjDk3Ok0JNW77pPTo+HHwhgB4pMU
fA7pxGHBsT81d9u7OAf0lqoQWXmTeRvs0B7EWcOQxEWYtXXg+Xuyhu/yTt5X2sYz
Xx0Du1YaCgGZfoHrpIwCie5PzpjxkVVWr8O7NdE9gEwbyTDwUnwQQROLpZRYKjKi
JKPMQVvp4DzJbUk4sSKoi4/vlR5Op5YDGIZ6Gn42B5PPF5TbrmoJjBQ5/DxIYcQG
qgIrlOSnPcX/BGvDZXydivgSvUAZEZy5F/QYIPsJX/MGAiiOZCWyuwty4GRQasKg
LLNHYWVEF3v6QDMzbj2Of9T+G/wj1yhuYN3ucQSID9loqi/Zl5c=
=aqen
-----END PGP SIGNATURE-----