You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@jena.apache.org by Brandon Sara <Br...@pointclickcare.com.INVALID> on 2023/07/20 16:18:25 UTC
CVE-2023-32200
I just came across CVE-2023-32200 and was wondering, is it different than CVE-2023-22665 and, if so, how is it different?
No PHI in Email: PointClickCare and Collective Medical, A PointClickCare Company, policies prohibit sending protected health information (PHI) by email, which may violate regulatory requirements. If sending PHI is necessary, please contact the sender for secure delivery instructions.
Confidentiality Notice: This email message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message.
Re: CVE-2023-32200
Posted by Brandon Sara <Br...@pointclickcare.com.INVALID>.
Awesome! Thanks for the quick response
> On Jul 20, 2023, at 11:13 AM, Andy Seaborne <an...@apache.org> wrote:
>
> "EXTERNAL EMAIL" – Always use caution when reviewing mail from outside of the organization.
>
>
>
> On 20/07/2023 17:18, Brandon Sara wrote:
>> I just came across CVE-2023-32200 and was wondering, is it different than CVE-2023-22665 and, if so, how is it different?
>
>
> Jena 4.8.0 addresses CVE-2023-22665 by requiring the Java system property "jena:scripting" to enable scripting.
>
> Jena 4.9.0 addresses CVE-2023-32200 which happens if scripting is enabled (4.8.0). The change goes further than only addressing the security issue by requiring script functions to be in an "allowed" list; that is, there is an API contract for callable scripts. Other functions in the script file are not callable which should help development.
>
> Running Java17 means there is no scripting engine unless the deployment
> has added one. Java11 has a scriting engine in the JDK.
>
> Andy
>
No PHI in Email: PointClickCare and Collective Medical, A PointClickCare Company, policies prohibit sending protected health information (PHI) by email, which may violate regulatory requirements. If sending PHI is necessary, please contact the sender for secure delivery instructions.
Confidentiality Notice: This email message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message.
Required Java version
Posted by Andy Seaborne <an...@apache.org>.
A reminder that Jena will move from requiring Java11 to requiring Java17.
The project aims to support for 2 LTS versions of Java.
Java21 is scheduled for September 19 this year and is LTS.
Some time after that date that Jena will switch, with a major version
bump to Jena 5.x.y
For Fuseki, Jena5 will use jakarta.* packages.
Jena is already tested for Java17 and Java21_latest_EA on a regular
basis. You can switch JVMs now.
Andy
Re: CVE-2023-32200
Posted by Andy Seaborne <an...@apache.org>.
On 20/07/2023 17:18, Brandon Sara wrote:
>
> I just came across CVE-2023-32200 and was wondering, is it different than CVE-2023-22665 and, if so, how is it different?
Jena 4.8.0 addresses CVE-2023-22665 by requiring the Java system
property "jena:scripting" to enable scripting.
Jena 4.9.0 addresses CVE-2023-32200 which happens if scripting is
enabled (4.8.0). The change goes further than only addressing the
security issue by requiring script functions to be in an "allowed" list;
that is, there is an API contract for callable scripts. Other functions
in the script file are not callable which should help development.
Running Java17 means there is no scripting engine unless the deployment
has added one. Java11 has a scriting engine in the JDK.
Andy