Debian LTS DLA-4229-1 critical: commons-beanutils access control flaw

commons-beanutils, utility for manipulating Java beans have an
improper Access Control vulnerability. A special BeanIntrospector
class was added in version 1.9.2. This can be used to stop attackers
from using the declared class property of Java enum objects to get
access to the classloader. However this protection was not enabled by
default. PropertyUtilsBean (and consequently BeanUtilsBean) now
disallows declared class level property access by default.


For Debian 11 bullseye, this problem has been fixed in version
1.9.4-1+deb11u1.

We recommend that you upgrade your commons-beanutils packages.

For the detailed security status of commons-beanutils please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/source-package/commons-beanutils

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS