You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@commons.apache.org by Toh Min <ts...@yahoo.com.INVALID> on 2023/01/12 02:56:30 UTC
Enquiry on commons-net 3.9
Hi,
I have an application running on Java 1.7 which may be using commons-net. I saw from the website that commons-net 3.9 requires Java 1.8.
I would like to resolve CVE-2021-37533 for commons-net, is there anything which I can do to mitigate it since the java version which I am using is lower than the minimum version for commons-net 3.9.
Thanks & Regards,
Min
Re: Enquiry on commons-net 3.9
Posted by Gary Gregory <ga...@gmail.com>.
That's not what Min is asking...
Min, if you must use Java 7, your only option is to fork the code, edit it
to comply with Java 7, and rebuild it locally.
Staying on Java 7 will likely be more painful IMO than migrating to Java 8.
Gary
On Thu, Jan 12, 2023, 04:32 Ruby Paasche <r....@pripares.com> wrote:
> Hi
>
> look at https://issues.apache.org/jira/browse/NET-711
> call FTPClient#setIpAddressFromPasvResponse(false);
> will do the job.
>
> Best Regards
> Ruby
>
>
> ‑‑
> Ruby Paasche
> Senior Entwicklerin
> Tel:
> +49 (0)89 45 22 808 ‑ 30
> Email:
> r.paasche@pripares.com
> Web:
> *https://pripares.com* <https://pripares.com/>
> PRIPARES Software Solutions GmbH
> Ridlerstraße 57
> 80339 München
> Handelsregister: Registergericht München HRB 138701
> Sitz der Gesellschaft: München
> Geschäftsführer: Aßmann Christoph, Ertl Andreas
>
> Diese E-Mail enthält vertrauliche und/oder rechtlich geschützte
> Informationen. Wenn Sie nicht der richtige Adressat sind oder diese E-Mail
> irrtümlich erhalten haben, informieren Sie bitte sofort den Absender und
> löschen Sie diese Mail. Das unerlaubte Kopieren sowie die unbefugte
> Weitergabe dieser Mail und der darin enthaltenen Informationen sind nicht
> gestattet.
>
> This e-mail may contain confidential and/or privileged information. If you
> are not the intended recipient (or have received this e-mail in error)
> please notify the sender immediately and delete this e-mail. Any
> unauthorized copying, disclosure or distribution of the material in this
> e-mail is strictly forbidden.
>
>
> Am Do., 12. Jan. 2023 um 10:13 Uhr schrieb Toh Min
> <ts...@yahoo.com.invalid>:
>
> > Hi,
> > I have an application running on Java 1.7 which may be using
> > commons-net. I saw from the website that commons-net 3.9 requires Java
> 1.8.
> > I would like to resolve CVE-2021-37533 for commons-net, is there anything
> > which I can do to mitigate it since the java version which I am using is
> > lower than the minimum version for commons-net 3.9.
> > Thanks & Regards,
> > Min
> >
>
Re: Enquiry on commons-net 3.9
Posted by Ruby Paasche <r....@pripares.com>.
Hi
look at https://issues.apache.org/jira/browse/NET-711
call FTPClient#setIpAddressFromPasvResponse(false);
will do the job.
Best Regards
Ruby
‑‑
Ruby Paasche
Senior Entwicklerin
Tel:
+49 (0)89 45 22 808 ‑ 30
Email:
r.paasche@pripares.com
Web:
*https://pripares.com* <https://pripares.com/>
PRIPARES Software Solutions GmbH
Ridlerstraße 57
80339 München
Handelsregister: Registergericht München HRB 138701
Sitz der Gesellschaft: München
Geschäftsführer: Aßmann Christoph, Ertl Andreas
Diese E-Mail enthält vertrauliche und/oder rechtlich geschützte
Informationen. Wenn Sie nicht der richtige Adressat sind oder diese E-Mail
irrtümlich erhalten haben, informieren Sie bitte sofort den Absender und
löschen Sie diese Mail. Das unerlaubte Kopieren sowie die unbefugte
Weitergabe dieser Mail und der darin enthaltenen Informationen sind nicht
gestattet.
This e-mail may contain confidential and/or privileged information. If you
are not the intended recipient (or have received this e-mail in error)
please notify the sender immediately and delete this e-mail. Any
unauthorized copying, disclosure or distribution of the material in this
e-mail is strictly forbidden.
Am Do., 12. Jan. 2023 um 10:13 Uhr schrieb Toh Min
<ts...@yahoo.com.invalid>:
> Hi,
> I have an application running on Java 1.7 which may be using
> commons-net. I saw from the website that commons-net 3.9 requires Java 1.8.
> I would like to resolve CVE-2021-37533 for commons-net, is there anything
> which I can do to mitigate it since the java version which I am using is
> lower than the minimum version for commons-net 3.9.
> Thanks & Regards,
> Min
>
Re: Enquiry on commons-net 3.9
Posted by Gary Gregory <ga...@gmail.com>.
The Java version requirement is already in the release notes:
https://archive.apache.org/dist/commons/net/RELEASE-NOTES.txt
Gary
On Thu, Jan 12, 2023, 14:17 Glavo <zj...@gmail.com> wrote:
> I understand that upgrading Java is not easy in some cases.
> However, for users who still need to update dependencies to solve CVE,
> I think it is important to remind them that Java 7 has ended its support.
>
>
>
> On Thu, Jan 12, 2023 at 8:24 PM Gary Gregory <ga...@gmail.com>
> wrote:
>
> > Hopefully there is no lost irony of updating a jar to a version that
> > requires Java 8 when the target Jaav 7 underlying platform has it's own
> > issues ;-) but it's not always simple to upgrade Java versions for some
> > customers...
> >
> > Gary
> >
> > On Thu, Jan 12, 2023, 06:16 Glavo <zj...@gmail.com> wrote:
> >
> > > Retrolambda may be able to help you:
> > >
> > > https://github.com/luontola/retrolambda
> > >
> > > But I think the best solution is to update to Java 8 and later.
> > > Because Java 7's life cycle ended in July last year, it has security
> > risks.
> > >
> > > On Thu, Jan 12, 2023 at 5:13 PM Toh Min <ts...@yahoo.com.invalid>
> > wrote:
> > >
> > > > Hi,
> > > > I have an application running on Java 1.7 which may be using
> > > > commons-net. I saw from the website that commons-net 3.9 requires
> Java
> > > 1.8.
> > > > I would like to resolve CVE-2021-37533 for commons-net, is there
> > anything
> > > > which I can do to mitigate it since the java version which I am using
> > is
> > > > lower than the minimum version for commons-net 3.9.
> > > > Thanks & Regards,
> > > > Min
> > > >
> > >
> >
>
Re: Enquiry on commons-net 3.9
Posted by Glavo <zj...@gmail.com>.
I understand that upgrading Java is not easy in some cases.
However, for users who still need to update dependencies to solve CVE,
I think it is important to remind them that Java 7 has ended its support.
On Thu, Jan 12, 2023 at 8:24 PM Gary Gregory <ga...@gmail.com> wrote:
> Hopefully there is no lost irony of updating a jar to a version that
> requires Java 8 when the target Jaav 7 underlying platform has it's own
> issues ;-) but it's not always simple to upgrade Java versions for some
> customers...
>
> Gary
>
> On Thu, Jan 12, 2023, 06:16 Glavo <zj...@gmail.com> wrote:
>
> > Retrolambda may be able to help you:
> >
> > https://github.com/luontola/retrolambda
> >
> > But I think the best solution is to update to Java 8 and later.
> > Because Java 7's life cycle ended in July last year, it has security
> risks.
> >
> > On Thu, Jan 12, 2023 at 5:13 PM Toh Min <ts...@yahoo.com.invalid>
> wrote:
> >
> > > Hi,
> > > I have an application running on Java 1.7 which may be using
> > > commons-net. I saw from the website that commons-net 3.9 requires Java
> > 1.8.
> > > I would like to resolve CVE-2021-37533 for commons-net, is there
> anything
> > > which I can do to mitigate it since the java version which I am using
> is
> > > lower than the minimum version for commons-net 3.9.
> > > Thanks & Regards,
> > > Min
> > >
> >
>
Re: Enquiry on commons-net 3.9
Posted by Gary Gregory <ga...@gmail.com>.
Hopefully there is no lost irony of updating a jar to a version that
requires Java 8 when the target Jaav 7 underlying platform has it's own
issues ;-) but it's not always simple to upgrade Java versions for some
customers...
Gary
On Thu, Jan 12, 2023, 06:16 Glavo <zj...@gmail.com> wrote:
> Retrolambda may be able to help you:
>
> https://github.com/luontola/retrolambda
>
> But I think the best solution is to update to Java 8 and later.
> Because Java 7's life cycle ended in July last year, it has security risks.
>
> On Thu, Jan 12, 2023 at 5:13 PM Toh Min <ts...@yahoo.com.invalid> wrote:
>
> > Hi,
> > I have an application running on Java 1.7 which may be using
> > commons-net. I saw from the website that commons-net 3.9 requires Java
> 1.8.
> > I would like to resolve CVE-2021-37533 for commons-net, is there anything
> > which I can do to mitigate it since the java version which I am using is
> > lower than the minimum version for commons-net 3.9.
> > Thanks & Regards,
> > Min
> >
>
Re: Enquiry on commons-net 3.9
Posted by Glavo <zj...@gmail.com>.
Retrolambda may be able to help you:
https://github.com/luontola/retrolambda
But I think the best solution is to update to Java 8 and later.
Because Java 7's life cycle ended in July last year, it has security risks.
On Thu, Jan 12, 2023 at 5:13 PM Toh Min <ts...@yahoo.com.invalid> wrote:
> Hi,
> I have an application running on Java 1.7 which may be using
> commons-net. I saw from the website that commons-net 3.9 requires Java 1.8.
> I would like to resolve CVE-2021-37533 for commons-net, is there anything
> which I can do to mitigate it since the java version which I am using is
> lower than the minimum version for commons-net 3.9.
> Thanks & Regards,
> Min
>