[DBCP-450] Veracode Static Analysis indicates SQL injection in Commons DBCP jar

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Invalid
• Affects Version/s: 2.0.1, 2.1.1
• Fix Version/s: 2.2.0
• Labels: security
• Flags: Important
• Assignee: Unassigned
• Reporter: I-Min Mau
• Created: 29/Oct/15 21:40
• Updated: 29/Oct/15 22:03
• Resolved: 29/Oct/15 21:57

Description

Veracode Static scan have indicated 3 High severity SQL injection flaws in this jar

Instances found via Static Scan
Module # Class # Module Location Fix By Flaw Id
8 - commons-dbcp2-
2.1.1.jar
.../DelegatingPreparedStatement.java 83 16477
9 - commons-dbcp2-
2.1.1.jar
.../DelegatingStatement.java 291 16479
17 - commons-dbcp2-
2.1.1.jar
.../PoolableConnectionFactory.java 325 16476