[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CAMopvkNZoHH3qx+9brdRdAoZ7zy9w6QPotjohVwqsopGEk=sgw@mail.gmail.com>
Date: Tue, 27 Mar 2018 12:16:58 +0200
From: Lukasz Lenart <lukaszlenart@...che.org>
To: Struts Users Mailing List <user@...uts.apache.org>
Cc: announce@...che.org, announcements@...uts.apache.org,
oss-security@...ts.openwall.com,
"Munoz, Alvaro" <alvaro.munoz@...rofocus.com>, "Grushka, Yevgeniy" <grushka@...rofocus.com>
Subject: [ANN] A crafted XML request can be used to perform a DoS attack when
using the Struts REST plugin
The Apache Security Struts Team recommends to immediately upgrade your
Struts 2 based projects to use the latest released version of the
Apache Struts. This is necessary to prevent your publicly accessible
web site, which is using the Struts REST plugin and performing XML
serialisation, from being exposed to possible DoS attack.
You can find more details in a Security Bulletin S2-056 -
https://cwiki.apache.org/confluence/display/WW/S2-056
All developers are strongly advised to perform this action.
Kind regards
--
Łukasz
+ 48 606 323 122 http://www.lenart.org.pl/
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
