This is an automated email from the ASF dual-hosted git repository.
jleroux pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/trunk by this push:
new 42bdd084e6 Fixed: CVE-2023-24998 Apache Commons FileUpload and Tomcat
- DoS with excessive parts (OFBIZ-12766)
42bdd084e6 is described below
commit 42bdd084e681268d8301f9c586c13eea5afd6d9b
Author: Jacques Le Roux <jacques.le.r...@les7arts.com>
AuthorDate: Tue Feb 21 08:59:58 2023 +0100
Fixed: CVE-2023-24998 Apache Commons FileUpload and Tomcat - DoS with
excessive parts (OFBIZ-12766)
See
https://commons.apache.org/proper/commons-fileupload/security-reports.html
https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.71
for details
---
build.gradle | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/build.gradle b/build.gradle
index 1a66fb4277..86b0e7ef81 100644
--- a/build.gradle
+++ b/build.gradle
@@ -226,7 +226,7 @@ dependencies {
implementation 'com.rometools:rome:1.18.0'
implementation 'com.thoughtworks.xstream:xstream:1.4.19'
implementation 'commons-cli:commons-cli:1.5.0'
- implementation 'commons-fileupload:commons-fileupload:1.4'
+ implementation 'commons-fileupload:commons-fileupload:1.5'
implementation 'commons-net:commons-net:3.8.0'
implementation 'commons-validator:commons-validator:1.7'
implementation 'de.odysseus.juel:juel-impl:2.2.7'
@@ -252,8 +252,8 @@ dependencies {
implementation 'org.apache.tika:tika-parsers:2.5.0'
implementation 'org.apache.tika:tika-parser-pdf-module:2.5.0'
implementation 'org.apache.cxf:cxf-rt-frontend-jaxrs:3.5.4'
- implementation 'org.apache.tomcat:tomcat-catalina-ha:9.0.69' // Remember
to change the version number (9 now) in javadoc block if needed.
- implementation 'org.apache.tomcat:tomcat-jasper:9.0.69'
+ implementation 'org.apache.tomcat:tomcat-catalina-ha:9.0.71' // Remember
to change the version number (9 now) in javadoc block if needed.
+ implementation 'org.apache.tomcat:tomcat-jasper:9.0.71'
implementation 'org.apache.axis2:axis2-kernel:1.8.2'
implementation 'batik:batik-svg-dom:1.6-1'
implementation 'org.apache.xmlgraphics:fop:2.3' // NOTE: since 2.4
dependencies are messed up. See
https://github.com/moqui/moqui-fop/blob/master/build.gradle
