Issue

CVE-2022-42889 - Arbitrary code execution in Apache Commons Text

 

Impact

Neo4j Database Server and Neo4j APOC were never vulnerable to the issue described in CVE-2022-42889. The third-party functions described in the referenced CVE are not being used by Neo4j. We are however proactively addressing the issue to ensure security scans do not flag it as a potential risk.

 

Affected (but not impacted) products and versions

• Neo4j Database Server 4.4.13 and previous patches
• Neo4j Database Server 4.3.20 and previous patches
• Neo4j APOC 4.4.0.10 and previous patches
• Neo4j APOC 4.3.0.9 and previous patches

Note: The Neo4j Database Server versions 4.4.13 and 4.3.20 include a fix (update of the Apache Commons-text library) but remain affected due to the presence of the APOC library that is affected. Manually removing the affected APOC library will remove the risk. If required, a new APOC library version is already available (see below).

 

Products and versions with fixes:

Patches containing the fixes released November 10th, 2022

• Neo4j Database Server 4.4.14 and later patches
• Neo4j Database Server 4.3.21 and later patches

[NOID] Fixes CVE-2022-42889 in transitive dependencies by @AzuObs in #3258 (Nov, 9th 2022)

• Neo4j APOC 4.4.0.11 and later patches
• Neo4j APOC 4.3.0.10 and later patches

 

With regards,

Neo4j Support