Date: Fri, 7 Jul 2017 18:47:13 +0200 From: Lukasz Lenart <lukaszlenart@...che.org> To: Struts Users Mailing List <user@...uts.apache.org> Cc: "announcements@...uts.apache.org" <announcements@...uts.apache.org>, Struts Developers List <dev@...uts.apache.org>, announce@...che.org, icez <ic3z@...com>, "security@...uts.apache.org" <security@...uts.apache.org>, oss-security@...ts.openwall.com, bugtraq@...urityfocus.com Subject: [ANN] Apache Struts 2: possible RCE in the Struts Showcase app in the Struts 1 plugin example in the Struts 2.3.x series A potential security vulnerability was reported in the Struts 1 plugin used in the Struts 2.3.x series. It is possible to perform a Remote Code Execution attack if given construction exists in the vulnerable application. Please read the security bulletin for more details and inspect your application. - S2-048 Possible RCE in the Struts Showcase app in the Struts 1 plugin example in Struts 2.3.x series http://struts.apache.org/docs/s2-048.html http://struts.apache.org/announce.html#a20170707 NOTE: Please notice that this vulnerability does not affect applications using Struts 2.5.x series or applications that do not use the Struts 1 plugin. Even if the plugin is available but certain code construction is not present, your application is safe. On behalf of the Apache Struts project Kind regards -- Łukasz + 48 606 323 122 http://www.lenart.org.pl/
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.