Skip to content

Upgrading commons-codec to 1.13 after sonatype-2012-0050 vulnerability#173

Closed
bahui80 wants to merge 2 commits intoapache:4.5.xfrom
bahui80:fix/vulnerability
Closed

Upgrading commons-codec to 1.13 after sonatype-2012-0050 vulnerability#173
bahui80 wants to merge 2 commits intoapache:4.5.xfrom
bahui80:fix/vulnerability

Conversation

@bahui80
Copy link
Copy Markdown

@bahui80 bahui80 commented Nov 9, 2019

Updating library needed to sort out vulnerability sonatype-2012-0050

Description:

The Apache commons-codec package contains an Improper Input Validation vulnerability. 
The decode() method in the Base32, Base64, and BCodec classes fails to reject malformed
Base32 and Base64 encoded strings and consequently decodes them into arbitrary values. 
A remote attacker can leverage this vulnerability to potentially tunnel additional
information via seemingly legitimate Base32 or Base64 encoded strings.

@ok2c
Copy link
Copy Markdown
Member

ok2c commented Nov 10, 2019

@bahui80 We have already upgraded master (5.0) to Commons Codec 1.13 but we cannot upgrade the 4.5.x branch due to version 1.13 incompatibility with Java 1.6 required by HttpClient 4.5.

@ok2c ok2c closed this Nov 10, 2019
@bahui80
Copy link
Copy Markdown
Author

bahui80 commented Nov 10, 2019

@ok2c i wasn't aware of the requisite of Java 1.6 for HttpClient. Thanks anyway!

@bahui80 bahui80 deleted the fix/vulnerability branch November 10, 2019 15:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants