Uploaded image for project: 'James Server'
  1. James Server
  2. JAMES-3192

Upgrade Apache configuration to 2.7

    XMLWordPrintableJSON

    Details

      Description

      CVE-2020-1953 enables Remote code execution in Apache Commons Configuration

      Apache Commons Configuration uses a third-party library to parse YAML files which by default allows the instantiation of classes if the YAML includes special statements. Apache Commons Configuration versions 2.2, 2.3, 2.4, 2.5, 2.6 did not change the default settings of this library. So if a YAML file was loaded from an untrusted source, it could therefore load and execute code out of the control of the host application.

      James server don't rely on YAML files for its configuration (only on XML and properties) thus we are likely unaffected by the aforementioned CVE but upgrading would be wise.

        Attachments

          Activity

            People

            • Assignee:
              Unassigned
              Reporter:
              btellier Benoit Tellier
            • Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved: