www-announce mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Lukasz Lenart <lukaszlen...@apache.org>
Subject [ANN] Immediately upgrade commons-fileupload to version 1.3.3
Date Tue, 27 Mar 2018 09:56:53 GMT
The Apache Struts Team recommends to immediately upgrade your Struts 2
based projects to use the latest released version of Commons
FileUpload library, which is currently 1.3.3. This is necessary to
prevent your publicly accessible web site from being exposed to
possible Remote Code Execution attacks (see [1] [2]).

This affects any Struts version prior to 2.5.12 [3].

Your project is affected if it uses the built-in file upload mechanism
of Struts 2, which defaults to the use of commons-fileupload. The
updated commons-fileupload library is a drop-in replacement for the
vulnerable version. Deployed applications can be hardened by replacing
the commons-fileupload jar file in WEB-INF/lib with the fixed jar. For
Maven based Struts 2 projects, the following dependency needs to be


More details can be found here:

1. https://issues.apache.org/jira/browse/FILEUPLOAD-279
2. https://nvd.nist.gov/vuln/detail/CVE-2016-1000031
3. https://issues.apache.org/jira/browse/WW-4812

All developers are strongly advised to perform this action.

Kind regards
+ 48 606 323 122 http://www.lenart.org.pl/

View raw message