D M Murali Krishna Reddy created TEZ-4353:
---------------------------------------------
Summary: Update commons-io to 2.7
Key: TEZ-4353
URL: https://issues.apache.org/jira/browse/TEZ-4353
Project: Apache Tez
Issue Type: Improvement
Reporter: D M Murali Krishna Reddy
[https://nvd.nist.gov/vuln/detail/CVE-2021-29425]
In Apache Commons IO before 2.7, When invoking the method
FileNameUtils.normalize with an improper input string, like "//../foo", or
"\\..\foo", the result would be the same value, thus possibly providing access
to files in the parent directory, but not further above (thus "limited" path
traversal), if the calling code would use the result to construct a path value.
It is better to upgrade from 2.4 to 2.7 to fix the vulnerability.
--
This message was sent by Atlassian Jira
(v8.20.1#820001)
