[MSHARED-979] maven-shared-components uses commons-io 2.6 which is vulnerable to sonatype-2018-0705

[jira-importer]

Scott Marshall opened MSHARED-979 and commented

maven-shared-components uses commons-io 2.6 which is vulnerable to sonatype-2018-0705

ISSUE

sonatype-2018-0705

SEVERITY

Sonatype CVSS 3:7.8
CVE CVSS 2.0:0.0
 

EXPLANATION

The commons-io package is vulnerable to Path Traversal. The getPrefixLength method in FilenameUtils.class improperly verifies the hostname value received from user input before processing client requests. An attacker could abuse this behavior by crafting a special payload containing unexpected characters that could allow the access to unintended resources.

ROOT CAUSE

commons-io-2.6.jarorg/apache/commons/io/FilenameUtils.class[1.1 , 2.7-SNAPSHOT)
org-apache-commons-io-RELEASE113.jarorg/apache/commons/io/FilenameUtils.class[1.1 , 2.7-SNAPSHOT)
 

ADVISORIES

Project:apache/commons-io#52
Project:https://issues.apache.org/jira/browse/IO-556
Project:https://issues.apache.org/jira/browse/IO-559

CVSS DETAILS

Sonatype CVSS 3:7.8
CVSS Vector:CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

---

Affects: maven-shared-utils-3.3.3

Issue Links:

• MSHARED-992 maven-shared-components uses commons-io 2.5 which is vulnerable
  ("is cloned by")
• MSHARED-992 maven-shared-components uses commons-io 2.5 which is vulnerable
  ("is duplicated by")
• MSHARED-1110 Upgrade components
  ("depends upon")

Backported to: maven-shared-utils-3.4.0

[jira-importer]

Elliotte Rusty Harold commented

do we use the vulnerable method? Or is this simply a case of something in the classpath?

 

What's really needed here is a 2.6.1 release of Apache Commons IO with the fix.

[jira-importer]

Michael Osipov commented

Fixed implicitly by MSHARED-1110.