You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@ofbiz.apache.org by "nmalin (via GitHub)" <gi...@apache.org> on 2025/01/22 16:21:30 UTC

[PR] Improved: [SECURITY] (CVE-2024-36104) Path traversal leading to RCE (OFBIZ-13092) [ofbiz-framework]

nmalin opened a new pull request, #873:
URL: https://github.com/apache/ofbiz-framework/pull/873

   Improved the denied token resolution through regexp pattern. We define each potential token
    and we generate the following regexp for each
   
   ****
     .*(%.{2,5}|[^\\w])" + token + "[^\\w].*"
   ****
   
   We also improved the allowed token with analysed it form security.properties and web.xml
    directly by plain text of with sha signature to manage each special case
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@ofbiz.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Improved: [SECURITY] (CVE-2024-36104) Path traversal leading to RCE (OFBIZ-13092) [ofbiz-framework]

Posted by "gilPts (via GitHub)" <gi...@apache.org>.
gilPts commented on PR #873:
URL: https://github.com/apache/ofbiz-framework/pull/873#issuecomment-2627758879

   To advance, since it is no more needed, we can let aside the part about : allowed token with analysed it form security.properties and web.xml directly by plain text of with sha signature to manage each special case.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@ofbiz.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Improved: [SECURITY] (CVE-2024-36104) Path traversal leading to RCE (OFBIZ-13092) [ofbiz-framework]

Posted by "JacquesLeRoux (via GitHub)" <gi...@apache.org>.
JacquesLeRoux commented on PR #873:
URL: https://github.com/apache/ofbiz-framework/pull/873#issuecomment-2745137987

   Hi Guys,
   
   Since we want to release 24.09.01, should we not close here?


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@ofbiz.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Improved: [SECURITY] (CVE-2024-36104) Path traversal leading to RCE (OFBIZ-13092) [ofbiz-framework]

Posted by "JacquesLeRoux (via GitHub)" <gi...@apache.org>.
JacquesLeRoux commented on PR #873:
URL: https://github.com/apache/ofbiz-framework/pull/873#issuecomment-2758991524

   Seems there is no need to keep this PR open


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@ofbiz.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Improved: [SECURITY] (CVE-2024-36104) Path traversal leading to RCE (OFBIZ-13092) [ofbiz-framework]

Posted by "JacquesLeRoux (via GitHub)" <gi...@apache.org>.
JacquesLeRoux commented on PR #873:
URL: https://github.com/apache/ofbiz-framework/pull/873#issuecomment-2612848710

   This is for 24.09 branch only, where there is currently an issue: https://lists.apache.org/thread/8dwrx5wwkjpfm5h0xtkwtnc3rpkbyoov


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@ofbiz.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Improved: [SECURITY] (CVE-2024-36104) Path traversal leading to RCE (OFBIZ-13092) [ofbiz-framework]

Posted by "JacquesLeRoux (via GitHub)" <gi...@apache.org>.
JacquesLeRoux commented on PR #873:
URL: https://github.com/apache/ofbiz-framework/pull/873#issuecomment-2613930472

   I have created https://issues.apache.org/jira/browse/OFBIZ-13204 for that


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@ofbiz.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Improved: [SECURITY] (CVE-2024-36104) Path traversal leading to RCE (OFBIZ-13092) [ofbiz-framework]

Posted by "sonarqubecloud[bot] (via GitHub)" <gi...@apache.org>.
sonarqubecloud[bot] commented on PR #873:
URL: https://github.com/apache/ofbiz-framework/pull/873#issuecomment-2607691349

   ## [![Quality Gate Passed](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/QualityGateBadge/qg-passed-20px.png 'Quality Gate Passed')](https://sonarcloud.io/dashboard?id=apache_ofbiz-framework&pullRequest=873) **Quality Gate passed**  
   Issues  
   ![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0 New issues](https://sonarcloud.io/project/issues?id=apache_ofbiz-framework&pullRequest=873&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)  
   ![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/accepted-16px.png '') [0 Accepted issues](https://sonarcloud.io/project/issues?id=apache_ofbiz-framework&pullRequest=873&issueStatuses=ACCEPTED)
   
   Measures  
   ![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_ofbiz-framework&pullRequest=873&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)  
   ![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0.0% Coverage on New Code](https://sonarcloud.io/component_measures?id=apache_ofbiz-framework&pullRequest=873&metric=new_coverage&view=list)  
   ![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0.0% Duplication on New Code](https://sonarcloud.io/component_measures?id=apache_ofbiz-framework&pullRequest=873&metric=new_duplicated_lines_density&view=list)  
     
   [See analysis details on SonarQube Cloud](https://sonarcloud.io/dashboard?id=apache_ofbiz-framework&pullRequest=873)
   
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@ofbiz.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Improved: [SECURITY] (CVE-2024-36104) Path traversal leading to RCE (OFBIZ-13092) [ofbiz-framework]

Posted by "sonarqubecloud[bot] (via GitHub)" <gi...@apache.org>.
sonarqubecloud[bot] commented on PR #873:
URL: https://github.com/apache/ofbiz-framework/pull/873#issuecomment-2627752582

   ## [![Quality Gate Passed](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/QualityGateBadge/qg-passed-20px.png 'Quality Gate Passed')](https://sonarcloud.io/dashboard?id=apache_ofbiz-framework&pullRequest=873) **Quality Gate passed**  
   Issues  
   ![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0 New issues](https://sonarcloud.io/project/issues?id=apache_ofbiz-framework&pullRequest=873&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)  
   ![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/accepted-16px.png '') [0 Accepted issues](https://sonarcloud.io/project/issues?id=apache_ofbiz-framework&pullRequest=873&issueStatuses=ACCEPTED)
   
   Measures  
   ![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_ofbiz-framework&pullRequest=873&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)  
   ![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0.0% Coverage on New Code](https://sonarcloud.io/component_measures?id=apache_ofbiz-framework&pullRequest=873&metric=new_coverage&view=list)  
   ![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0.0% Duplication on New Code](https://sonarcloud.io/component_measures?id=apache_ofbiz-framework&pullRequest=873&metric=new_duplicated_lines_density&view=list)  
     
   [See analysis details on SonarQube Cloud](https://sonarcloud.io/dashboard?id=apache_ofbiz-framework&pullRequest=873)
   
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@ofbiz.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Improved: [SECURITY] (CVE-2024-36104) Path traversal leading to RCE (OFBIZ-13092) [ofbiz-framework]

Posted by "JacquesLeRoux (via GitHub)" <gi...@apache.org>.
JacquesLeRoux closed pull request #873: Improved: [SECURITY] (CVE-2024-36104) Path traversal leading to RCE (OFBIZ-13092)
URL: https://github.com/apache/ofbiz-framework/pull/873


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@ofbiz.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org