Details
-
Type:
Task
-
Status: Closed
-
Priority:
Major
-
Resolution: Fixed
-
Affects Version/s: EE-4.3.0.GA_P01
-
Fix Version/s: EE-4.3.0.GA_P02
-
Component/s: Framework, Sample Apps
-
Labels:None
-
Environment:external jars, security
-
Support Case References:Support Case 14503:- https://icesoft.my.salesforce.com/5000g000027qZtm
-
Workaround Description:Mojarra does not seem to serialize the view state token for server side state saving
Description
A security scan has shown issues with up to the the myfaces 2.2.12 version. see
https://issues.apache.org/jira/browse/MYFACES-4133
this has been resolved in myfaces - 2.3.0, so that version of the jar should be tested/included in next release.
other jars that have security scans may be used in our samples and should also be updated if possible:-
commons-beanutils : commons-beanutils : 1.9.2 Open or 1.9.3
dom4j : 1.6.1 Open
javax.servlet : jstl : 1.2 Open
org.apache.poi : poi : 3.9 Open
org.glassfish : javax.faces : 2.3.5 Open --scan states The getLocalePrefix function in ResourceManager.java in Eclipse Mojarra before 2.3.7 is affected by Directory Traversal via the loc parameter. A remote attacker can download configuration files or Java bytecodes from applications.
Explanation v 2.3.4 and 2.3.5 are only versions that are vulnerable, so stay away from these 2 versions of mojarra.
https://issues.apache.org/jira/browse/MYFACES-4133
this has been resolved in myfaces - 2.3.0, so that version of the jar should be tested/included in next release.
other jars that have security scans may be used in our samples and should also be updated if possible:-
commons-beanutils : commons-beanutils : 1.9.2 Open or 1.9.3
dom4j : 1.6.1 Open
javax.servlet : jstl : 1.2 Open
org.apache.poi : poi : 3.9 Open
org.glassfish : javax.faces : 2.3.5 Open --scan states The getLocalePrefix function in ResourceManager.java in Eclipse Mojarra before 2.3.7 is affected by Directory Traversal via the loc parameter. A remote attacker can download configuration files or Java bytecodes from applications.
Explanation v 2.3.4 and 2.3.5 are only versions that are vulnerable, so stay away from these 2 versions of mojarra.
Activity
- All
- Comments
- History
- Activity
- Remote Attachments
- Subversion
| Repository | Revision | Date | User | Message |
| ICEsoft Public SVN Repository | #53228 | Mon Jun 01 17:45:49 MDT 2020 | art.zambrano | |
| Files Changed | ||||
MODIFY
/icefaces4/trunk/icefaces/mobi/pom.xml
MODIFY
/icefaces4/trunk/icefaces/ace/themes/ace-redmond/pom.xml
|
| Repository | Revision | Date | User | Message |
| ICEsoft Public SVN Repository | #53222 | Wed May 20 14:45:48 MDT 2020 | art.zambrano | |
| Files Changed | ||||
|
MODIFY
/icefaces4/trunk/icefaces/mobi/component/build.xml
ADD
/icefaces4/trunk/icefaces/lib/mobi/jaxb-api-2.3.1.jar
ADD
/icefaces4/trunk/icefaces/lib/mobi
|
| Repository | Revision | Date | User | Message |
| ICEsoft Public SVN Repository | #53218 | Tue May 19 17:52:02 MDT 2020 | art.zambrano | |
| Files Changed | ||||
|
MODIFY
/icefaces4/trunk/icefaces/samples/showcase/pom.xml
|
| Repository | Revision | Date | User | Message |
| ICEsoft Public SVN Repository | #53214 | Thu May 07 15:49:01 MDT 2020 | art.zambrano | |
| Files Changed | ||||
|
MODIFY
/icefaces4/trunk/icefaces/samples/showcase/pom.xml
MODIFY
/icefaces4/trunk/icefaces/samples/ace/pom.xml
|
| Repository | Revision | Date | User | Message |
| ICEsoft Public SVN Repository | #53180 | Wed Apr 22 15:43:19 MDT 2020 | art.zambrano | |
| Files Changed | ||||
|
MODIFY
/icefaces4/trunk/icefaces/lib/versions-licenses.html
|