You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@poi.apache.org by bu...@apache.org on 2024/02/29 15:56:17 UTC
[Bug 68691] New: CVE-2024-26308
https://bz.apache.org/bugzilla/show_bug.cgi?id=68691
Bug ID: 68691
Summary: CVE-2024-26308
Product: POI
Version: 5.2.3-FINAL
Hardware: PC
OS: Mac OS X 10.1
Status: NEW
Severity: normal
Priority: P2
Component: XSSF
Assignee: dev@poi.apache.org
Reporter: jorge.mascarell@gmail.com
Target Milestone: ---
Current version 5.2.5 provides transitive vulnerable dependency
org.apache.commons:commons-compress:1.25.0.
This vulnerability has been fixed in org.apache.commons:commons-compress:1.26.0
https://mvnrepository.com/artifact/org.apache.commons/commons-compress
Therefore, the dependency should be updated to new version to avoid the
vulnerability.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For additional commands, e-mail: dev-help@poi.apache.org
[Bug 68691] CVE-2024-26308
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=68691
Axel Howind <ax...@dua3.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
OS|Mac OS X 10.1 |All
Resolution|--- |FIXED
Status|NEW |RESOLVED
--- Comment #2 from Axel Howind <ax...@dua3.com> ---
trunk has already been updated to use commons-compress 1.26.0, so this will be
in the next release. Users of the current version of POI can override the
version used in their Maven or Gradle build files.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For additional commands, e-mail: dev-help@poi.apache.org
[Bug 68691] CVE-2024-26308
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=68691
--- Comment #1 from Jorge Mascarell <jo...@gmail.com> ---
The vulnerability fixed in commons-compress:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26308
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For additional commands, e-mail: dev-help@poi.apache.org
[Bug 68691] CVE-2024-26308
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=68691
Jorge Mascarell <jo...@gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |jorge.mascarell@gmail.com
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For additional commands, e-mail: dev-help@poi.apache.org
[Bug 68691] CVE-2024-26308
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=68691
--- Comment #3 from PJ Fanning <fa...@yahoo.com> ---
POI doesn't even use the pack200 code. POI tests run fine with the latest
commons-compress jar.
We are not going to expedite a POI release. Feel free to update your build to
use a newer commons-compress jar.
If you have a POC that demos that POI 5.2.5 is actually affected, please
provide it privately using the security guidelines.
https://poi.apache.org/security.html
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For additional commands, e-mail: dev-help@poi.apache.org