The title ("CVE-2022-42889: Java Apache Commons vulerability") is overly broad and suggests that somehow the whole Apache Commons project, which consists of over 40 components, has a vulnerability
To be clear, this is about a handful of utility functions in one of the libraries. Unless you are actively using those functions, you should be fine. And if you are, you'd be misguided to pass in unvalidated input straight from your APIs. That's almost always a bad idea with any library that implements functionality like this.
And of course it's something any security auditing would check on principle to see what falls over. I've been on multiple such projects where we found issues like this with other forms of string interpolation. It's a common junior mistake to not handle input properly and only do happy path testing.
If you are using these functions with e.g. configuration files or other strings under your control, it's not a problem; as that's pretty much the way this stuff is intended to be used. Disabling this is biasing on the border of better safe than sorry; which is a good thing of course. But if you need it, it's nice to not have to reinvent the wheel.
The other thing that's useful to know is that the maintainers of the Apache commons libraries have been pretty good about maintaining API compatibility. Some of these libraries have very infrequent updates but it still happens. Usually, updating these libraries is very low risk. I've never really seen good reasons to not update to minor releases of any apache commons libraries. You get bug fixes, some new functions, and generally no breakage whatsoever. And in the rare case something needs fixing, it's probably for a good reason.
https://commons.apache.org/proper/commons-text/changes-repor...
If I read the disclosure correctly, it's been vulnerable for four of the five years it's been publicly available.
Up to a point. As with all CVEs, the issue tend to be whether your dependencies are using it, or their dependencies, etc, etc.
mvn dependency:tree -Dverbose
[0] https://mvnrepository.com/artifact/org.apache.commons/common...
Nobody familiar with Java would interpret it this way. Also it's probably correct. There are vulnerabilities lurking in all software of any size and functionality, and Apache Commons is no exception.
When I read the title in the morning I had a short moment of panic because we make extensive use of for example Apache Commons Collections in our projects. Updating these libraries and delivering the fixes to customers would have resulted in quite some work.
If the title would have been more accurate it would probably have saved me from a mini heart-attack in the morning.
If the vulnerability is just in one component, it is important to be specific about which one it is.
Does anyone know what depends on Commons Text?
Edit: "Artifacts using Apache Commons Text" according to Maven:
https://mvnrepository.com/artifact/org.apache.commons/common...
There are some well-known projects that might be impacted: Hadoop, Spark, Velocity, Hive, Solr, and many more.