You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@struts.apache.org by "henrikplate (via GitHub)" <gi...@apache.org> on 2023/12/20 13:04:13 UTC
[PR] Fix CVE-2023-50164 in 2-3-x [struts]
henrikplate opened a new pull request, #819:
URL: https://github.com/apache/struts/pull/819
Parameters related to file uploads, esp. `<xxx>FileName`, will be added only after existing parameters with identical names (case-insensitive) have been removed.
Since the 2-5-x class `HttpParameters` is not available yet, the fix is done very locally in class `FileUploadInterceptor`, i.e. other potential parameter pollutions are not covered (e.g. during the later execution of other interceptors that also update the parameters).
The fix has been tested using a [vulnerable test application](https://github.com/henrikplate/struts-demo).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix CVE-2023-50164 in 2-3-x [struts]
Posted by "lukaszlenart (via GitHub)" <gi...@apache.org>.
lukaszlenart merged PR #819:
URL: https://github.com/apache/struts/pull/819
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix CVE-2023-50164 in 2-3-x [struts]
Posted by "henrikplate (via GitHub)" <gi...@apache.org>.
henrikplate commented on PR #819:
URL: https://github.com/apache/struts/pull/819#issuecomment-1864796827
Apart from assessing whether the fix works, I guess the other important question is whether it is worthwhile to produce a version 2.3.38 for the EOL release branch 2-3-x. The severity of this CVE could be one motivation, however, other severe vulnerabilities would remain unaddressed...
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org