Skip to content
This repository was archived by the owner on Nov 29, 2022. It is now read-only.
This repository was archived by the owner on Nov 29, 2022. It is now read-only.

Update Venocity for CVE-2021-29425 Mitigation #513

@jasonparallel

Description

@jasonparallel

The current version of Venocity uses the shade plugin to copy commons-io:commons-io:2.5 into it's jar (in it's namespace).

CVE-2021-29425
"In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value."

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions