You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@ofbiz.apache.org by "ASF subversion and git services (Jira)" <ji...@apache.org> on 2023/04/08 09:36:00 UTC
[jira] [Commented] (OFBIZ-12794) Disallow string concatenation in uploaded files
[ https://issues.apache.org/jira/browse/OFBIZ-12794?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17709864#comment-17709864 ]
ASF subversion and git services commented on OFBIZ-12794:
---------------------------------------------------------
Commit f65b24aed02738273a2ee243ccfad5a5469f4e58 in ofbiz-framework's branch refs/heads/release22.01 from Jacques Le Roux
[ https://gitbox.apache.org/repos/asf?p=ofbiz-framework.git;h=f65b24aed0 ]
Fixed: Disallow string concatenation in uploaded files (OFBIZ-12794)
An external security reporter brought to our attention that a signed up user
could upload a webshell using string concatenation. Of course there is no reason
for a signed up user to upload a webshell. And anyway we don't create CVEs for
signed up users trying our security.
Nevertheless we have decided to fix this possibility while allowing to bypass it
using a new security property. The later can be useful when a file must contain
a string concatenation, images files, seen as encoded texts, come to mind.
Thanks: so far unknown security reporter
> Disallow string concatenation in uploaded files
> -----------------------------------------------
>
> Key: OFBIZ-12794
> URL: https://issues.apache.org/jira/browse/OFBIZ-12794
> Project: OFBiz
> Issue Type: Bug
> Components: framework/security
> Affects Versions: 22.01.01
> Reporter: Jacques Le Roux
> Assignee: Jacques Le Roux
> Priority: Major
> Fix For: 22.01.01
>
>
> An external security reporter brought to our attention that a signed up user could upload a webshell using string concatenation. Of course there is no reason for a signed up user to upload a webshell. And anyway we don't create CVEs for signed up users trying our security.
> Nevertheless we have decided to fix this possibility while allowing to bypass it using a new security property. The later can be usefull when a file must contain a string concatenation, images files, seen as encoded texts, come to mind.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)