3 ms·
The title ("CVE-2022-42889: Java Apache Commons vulerability") is overly broad and suggests that somehow the whole Apache Commons project, which consists of ove
by gjvc 4y ago
The title ("CVE-2022-42889: Java Apache Commons vulerability") is overly broad and suggests that somehow the whole Apache Commons project, which consists of over 40 components, has a vulnerability.
Nobody familiar with Java would interpret it this way. Also it's probably correct. There are vulnerabilities lurking in all software of any size and functionality, and Apache Commons is no exception.
- jabiko 4y ago> Nobody familiar with Java would interpret it this way When I read the title in the morning I had a short moment of panic because we make extensive use of for example Apache Commons Collections in our projects. Updating these libraries and delivering the fixes to customers would have resulted in quite some work. If the title would have been more accurate it would probably have saved me from a mini heart-attack in the morning.
- thesuperbigfrog 4y agoApache Commons has 43 components: https://commons.apache.org/ https://commons.apache.org/ If the vulnerability is just in one component, it is important to be specific about which one it is. Does anyone know what depends on Commons Text? Edit: "Artifacts using Apache Commons Text" according to Maven: https://mvnrepository.com/artifact/org.apache.commons/commons-text/usages https://mvnrepository.com/artifact/org.apache.commons/common... There are some well-known projects that might be impacted: Hadoop, Spark, Velocity, Hive, Solr, and many more.