Exasol Virtual Schema Lua 0.5.6, released 2025-08-28

Code name: Fixes for vulnerabilities CVE-2024-55551 and CVE-2025-48924

Summary

This release fixes the following vulnerabilities:

CVE-2025-48924 (CWE-674) in dependency org.apache.commons:commons-lang3:jar:3.16.0:test

Uncontrolled Recursion vulnerability in Apache Commons Lang.

This issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0.

The methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a StackOverflowError could cause an application to stop.

Users are recommended to upgrade to version 3.18.0, which fixes the issue.

CVE: CVE-2025-48924 CWE: CWE-674

References

• https://ossindex.sonatype.org/vulnerability/CVE-2025-48924?component-type=maven&component-name=org.apache.commons%2Fcommons-lang3&utm_source=ossindex-client&utm_medium=integration&utm_content=1.8.1
• http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2025-48924
• https://github.com/advisories/GHSA-j288-q9x7-2f5v

CVE-2024-55551 (CWE-94) in dependency com.exasol:exasol-jdbc:jar:25.2.2:test

An issue was discovered in Exasol jdbc driver 24.2.0. Attackers can inject malicious parameters into the JDBC URL, triggering JNDI injection during the process when the JDBC Driver uses this URL to connect to the database. This can further lead to remote code execution vulnerability.

CVE: CVE-2024-55551 CWE: CWE-94

References

• https://ossindex.sonatype.org/vulnerability/CVE-2024-55551?component-type=maven&component-name=com.exasol%2Fexasol-jdbc&utm_source=ossindex-client&utm_medium=integration&utm_content=1.8.1
• http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-55551
• https://gist.github.com/azraelxuemo/9565ec9219e0c3e9afd5474904c39d0f

Security

• #64: Fixed vulnerability CVE-2025-48924 in dependency org.apache.commons:commons-lang3:jar:3.16.0:test
• #59: Fixed vulnerability CVE-2024-55551 in dependency com.exasol:exasol-jdbc:jar:25.2.2:test

Dependency Updates

Test Dependency Updates

• Updated com.exasol:exasol-testcontainers:7.1.3 to 7.1.7

Plugin Dependency Updates

• Updated com.exasol:project-keeper-maven-plugin:5.0.0 to 5.2.3
• Added io.github.git-commit-id:git-commit-id-maven-plugin:9.0.1
• Removed io.github.zlika:reproducible-build-maven-plugin:0.17
• Added org.apache.maven.plugins:maven-artifact-plugin:3.6.0
• Updated org.apache.maven.plugins:maven-failsafe-plugin:3.5.2 to 3.5.3
• Updated org.apache.maven.plugins:maven-surefire-plugin:3.5.2 to 3.5.3
• Updated org.jacoco:jacoco-maven-plugin:0.8.12 to 0.8.13
• Updated org.sonarsource.scanner.maven:sonar-maven-plugin:5.0.0.4389 to 5.1.0.4751