[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CAMopvkPHCrVRX7TuyyzdHp2wv6Pc8-f4=sqmSxPiE04md7SMug@mail.gmail.com>
Date: Fri, 7 Jul 2017 18:47:13 +0200
From: Lukasz Lenart <lukaszlenart@...che.org>
To: Struts Users Mailing List <user@...uts.apache.org>
Cc: "announcements@...uts.apache.org" <announcements@...uts.apache.org>,
Struts Developers List <dev@...uts.apache.org>, announce@...che.org, icez <ic3z@...com>,
"security@...uts.apache.org" <security@...uts.apache.org>, oss-security@...ts.openwall.com,
bugtraq@...urityfocus.com
Subject: [ANN] Apache Struts 2: possible RCE in the Struts Showcase app in the
Struts 1 plugin example in the Struts 2.3.x series
A potential security vulnerability was reported in the Struts 1 plugin
used in the Struts 2.3.x series. It is possible to perform a Remote
Code Execution attack if given construction exists in the vulnerable
application. Please read the security bulletin for more details and
inspect your application.
- S2-048 Possible RCE in the Struts Showcase app in the Struts 1
plugin example in Struts 2.3.x series
http://struts.apache.org/docs/s2-048.html
http://struts.apache.org/announce.html#a20170707
NOTE: Please notice that this vulnerability does not affect
applications using Struts 2.5.x series or applications that do not use
the Struts 1 plugin. Even if the plugin is available but certain code
construction is not present, your application is safe.
On behalf of the Apache Struts project
Kind regards
--
Łukasz
+ 48 606 323 122 http://www.lenart.org.pl/
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
