Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Block one more gadget type (org.glassfish.web/javax.servlet.jsp.jstl, CVE-2020-35728) #2999

Closed
cowtowncoder opened this issue Dec 23, 2020 · 2 comments
Closed

Block one more gadget type (org.glassfish.web/javax.servlet.jsp.jstl, CVE-2020-35728) #2999

cowtowncoder opened this issue Dec 23, 2020 · 2 comments
Labels
CVE Issues related to public CVEs (security vuln reports)

Comments

@cowtowncoder
Copy link
Member

cowtowncoder commented Dec 23, 2020 •
edited
Loading

Another gadget type(s) reported regarding class(es) of org.glassfish.web/javax.servlet.jsp.jstl library.
See https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 for description of the general problem.

Reporter(s): bu5yer (of Sangfor FarSight Security Lab)
Mitre id: CVE-2020-35728

Note: derivative of #2469 (embedded Xalan)

Fix is included in:
@cowtowncoder cowtowncoder added the CVE Issues related to public CVEs (security vuln reports) label Dec 23, 2020
@cowtowncoder cowtowncoder changed the title Block 1 more gadget types (placeholder) Block 1 more gadget type (org.glassfish.web/javax.servlet.jsp.jstl) Dec 26, 2020
@cowtowncoder cowtowncoder changed the title Block 1 more gadget type (org.glassfish.web/javax.servlet.jsp.jstl) Block 1 more gadget type (org.glassfish.web/javax.servlet.jsp.jstl, CVE-2020-35728) Dec 27, 2020
cowtowncoder added a commit that referenced this issue Dec 27, 2020
@cowtowncoder
Update release notes wrt #2999, cve id
8c9e28f
@cowtowncoder cowtowncoder changed the title Block 1 more gadget type (org.glassfish.web/javax.servlet.jsp.jstl, CVE-2020-35728) Block one more gadget type (org.glassfish.web/javax.servlet.jsp.jstl, CVE-2020-35728) Dec 27, 2020
@jbonofre
Copy link

jbonofre commented Jan 5, 2021

Any ETA for 2.9.10.8 release ?

@cowtowncoder
Copy link
Member Author

Wanted to wait until end of 2020 (end-of-life for 2.9.10 branch, officially), and couple of days past in case some reports were in-flight. But hopefully I'll get micro-patch release by the end of this week. So within 6 days or so.

tkanafa-atlassian added a commit to atlassian/jackson-1 that referenced this issue Apr 20, 2021
@tkanafa-atlassian
MNSTR-5023 backport security fix from jackson2
1a34ecd 
Merged from FasterXML/jackson-databind#2999
tkanafa-atlassian added a commit to atlassian/jackson-1 that referenced this issue Apr 20, 2021
@tkanafa-atlassian
MNSTR-5023 backport security fix from jackson2 - Block one more gadge…
f2d0a7c 
…t type (org.glassfish.web/javax.servlet.jsp.jstl, CVE-2020-35728)

Merged from FasterXML/jackson-databind#2999
@cxronen cxronen mentioned this issue Mar 4, 2022
Open
This was referenced May 10, 2022
Open
Open
@scott-cx scott-cx mentioned this issue Aug 1, 2022
Open
@cxronen cxronen mentioned this issue Sep 20, 2022
Open
@margaritalm margaritalm mentioned this issue Dec 25, 2022
Open
@cxronen cxronen mentioned this issue Dec 20, 2022
Open
@cxronen cxronen mentioned this issue Feb 17, 2023
Open
@cxronen cxronen mentioned this issue Nov 22, 2022
Open
This was referenced Mar 14, 2023
Open
Open
@cxronen cxronen mentioned this issue Apr 13, 2023
Open
@cxronen cxronen mentioned this issue May 25, 2023
Open
@cxronen cxronen mentioned this issue May 25, 2023
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
CVE Issues related to public CVEs (security vuln reports)
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@cowtowncoder @jbonofre