Ce mail provient de l'extérieur, restons vigilants

=====================================================================

                            CERT-Renater

                Note d'Information No. 2025/VULN587
_____________________________________________________________________

DATE                : 08/09/2025

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Apache Jackrabbit Core,
           Apache Jackrabbit JCR Commons versions prior to 2.22.2.

=====================================================================
https://lists.apache.org/thread/g25ygmgo3yjbp83bvm2mv5whptgqdtqd
_____________________________________________________________________

CVE-2025-58782: Apache Jackrabbit Core, Apache Jackrabbit JCR 
Commons: JNDI injection risk with JndiRepositoryFactory

Severity: important 

Affected versions:

- Apache Jackrabbit Core (org.apache.jackrabbit:jackrabbit-core)
1.0.0 through 2.22.1
- Apache Jackrabbit JCR Commons
(org.apache.jackrabbit:jackrabbit-jcr-commons) 1.0.0 through 2.22.1


Description:

Deserialization of Untrusted Data vulnerability in Apache Jackrabbit
Core and Apache Jackrabbit JCR Commons.

This issue affects Apache Jackrabbit Core: from 1.0.0 through 2.22.1;
Apache Jackrabbit JCR Commons: from 1.0.0 through 2.22.1.

Deployments that accept JNDI URIs for JCR lookup from untrusted users
allows them to inject malicious JNDI references, potentially leading
to arbitrary code execution through deserialization of untrusted data.
Users are recommended to upgrade to version 2.22.2. JCR lookup through
JNDI has been disabled by default in 2.22.2. Users of this feature
need to enable it explicitly and are adviced to review their use of
JNDI URI for JCR lookup.

This issue is being tracked as JCR-5135 


Credit:

James John (reporter)


References:

https://jackrabbit.apache.org/
https://www.cve.org/CVERecord?id=CVE-2025-58782
https://issues.apache.org/jira/browse/JCR-5135


=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================