ALT-PU-2026-4919-3

Package update velocity in branch sisyphus

Version2.4.1-alt1

Published2026-04-06

Max severityHIGH

Severity:

Closed issues (3)

HIGH8.8

Уязвимость механизма шаблонов на основе Java velocity, связанная с неверным управлением генерацией кода, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании

Published: 2022-01-17Modified: 2023-11-21

CVSS 3.xHIGH 8.8

CVSS:3.x/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS 2.0CRITICAL 9.0

CVSS:2.0/AV:N/AC:L/Au:S/C:C/I:C/A:C

References

CVE-2020-13936

HIGH8.8

An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache Velocity Engine versions up to 2.2.

Published: 2021-03-10Modified: 2024-11-21

CVSS 2.0CRITICAL 9.0

CVSS:2.0/AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS 3.xHIGH 8.8

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

GHSA-59j4-wjwp-mw9m

HIGH8.8

Sandbox Bypass in Apache Velocity Engine

Published: 2022-01-06Modified: 2022-04-01

CVSS 3.xHIGH 8.8

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References