[GHSA-prjv-jj26-wf8h] ClassLoader manipulation in Apache Struts #4239
Conversation
|
Hi @MarkLee131, I think this is not the correct commit link. apache/struts@74e2683 was committed on 10 January 2016. https://bugzilla.redhat.com/show_bug.cgi?id=1091939 states that the vulnerability was fixed in Apache Struts version 2.3.16.2 and https://nvd.nist.gov/vuln/detail/CVE-2014-0112 says the vulnerability was fixed in 2.3.20. According to https://mvnrepository.com/artifact/org.apache.struts/struts2-core, versions 2.3.16.2 and 2.3.20 were both released in 2014. Therefore, apache/struts@74e2683 is too new to be the fix commit. |
|
👋 This pull request has been marked as stale because it has been open with no activity. You can: comment on the issue or remove the stale label to hold stale off for a while, add the |
Updates
Comments
Add a patch apache/struts@74e2683, of which the commit message claims
Adds additional pattern to prevent access to getClass method. This shows its correlation with the root cause of this cveThe Struts 2 ParametersInterceptor was updated to block access to the 'class' parameter, but not all forms in which this parameter can be specified were blockedas claimed by Redhat: https://bugzilla.redhat.com/show_bug.cgi?id=1091939.