OESA-2021-1182

Dashboard / Vulnerabilities / OESA-2021-1182

OESA-2021-1182

Summary: apache-commons-io security update

Details: Apache commons IO library is used for developing IO functionality. It contains a collecton of utilities with utility classes, stream implementations, file filters, file comparators, endian transformation classes, and much more. Security Fix(es): In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like //../foo , or .. foo , the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus limited path traversal), if the calling code would use the result to construct a path value.(CVE-2021-29425)

References: https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1182, https://nvd.nist.gov/vuln/detail/CVE-2021-29425