[SOLR-14905] Update commons-io version to 2.8.0 due to security vulnerability

• Type: Improvement
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 8.6.2
• Fix Version/s: 8.7
• Component/s: security
• Assignee: Unassigned
• Reporter: Nazerke Seidan
• Created: 30/Sep/20 09:23
• Updated: 04/Nov/20 15:22
• Resolved: 01/Oct/20 09:32

Description

The commons-io (version 2.6) package is vulnerable to Path Traversal. The getPrefixLength method in FilenameUtils.class improperly verifies the hostname value received from user input before processing client requests.

The issue has been fixed in 2.7 onward:

(https://issues.apache.org/jira/browse/IO-556, https://issues.apache.org/jira/browse/IO-559) 

Issue Links

• links to: GitHub Pull Request #1934
• links to: GitHub Pull Request #1935