Back launchpad.net

2161582

launchpad.net • July 24, 2026

The current version of commons-beanutils in ESM Apps Legacy is 1.9.2-3ubuntu0. 1~esm1. Previously, prior to its transition to Legacy status, commons-beanutils contained a security fix for CVE-2014- 0114/CVE- 2019-10086, which was released as 1.9.2-3ubuntu0. 1~esm1. We now have two identical versions of commons-beanutils, one in ESM Apps and one in ESM Apps Legacy, but they differ in terms of which CVEs are addressed. The release in ESM Apps Legacy only fixes CVE-2025-48734, while the version in ESM Apps only fixes CVE-2014- 0114/CVE- 2019-10086.

To remediate this, the version in ESM Apps Legacy should be bumped and the aforementioned fix for CVE-2014- 0114/CVE- 2019-10086 should be included within the new version to avoid customers losing security fixes.

Bug watches keep track of this bug in other bug trackers.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Security Flaws in Commons-Beanutils and Libapache-Mod-Jk Require Immediate Attention Two vulnerabilities have been identified in commons-beanutils and libapache-mod-jk affecting ESM Apps Legacy systems. The commons-beanutils version 1.9.2-3ubuntu0.1~esm1 only addresses CVE-2025-48734, while the version in ESM Apps fixes CVE-2014-0114 and CVE-2019-10086. Similarly, libapache-mod-jk version 1:1.2.41-1ubuntu0.1~esm1 only addresses CVE-2024-46544, while the ESM Apps version fixes CVE-2023-41081. This discrepancy means that customers using ESM Apps Legacy may be exposed to known vulnerabilities. To mitigate this risk, updates to both packages are necessary to include the missing security fixes. Failure to address these issues could lead to potential exploitation of unpatched vulnerabilities. The current status indicates that bug watches are tracking these issues for further updates. 2 sources 58

Extracted Entities

CVEs (1)

CVE-2025-48734