3 ms·
It's an insecure feature, by default. Most people don't need it and it exposes you to serious security risk. The fix is just to turn it off by default. If yo
by MattPalmer1086 4y ago
It's an insecure feature, by default. Most people don't need it and it exposes you to serious security risk.
The fix is just to turn it off by default. If you need it, presumably you will have to ensure that untrusted or unsanitised user input can't reach it.
- vbezhenar 4y agoIt might be true, but assigning CVE just because someone thinks that some API is not secure enough in some random library looks very strange to me. I understand that it's similar to log4shell vulnerability in that regard, but log4j was much more popular than this commons-text library. I'm Java developer and I used commons libraries many times, but I never heard about this particular library so I'm curious where that particular API is used.
- MattPalmer1086 4y agoRenote code execution is about as serious as you can get. Any API that could result in that unintentionally should have a CVE assigned to it. Vulnerabilities are not bugs. They are vulnerabilities. They often arise from bugs, but not always.