Re: Apache commons fileupload migration

2018-03-20 Thread Christopher Schultz
Shawn, On 3/20/18 9:13 AM, Shawn Heisey wrote: > On 3/15/2018 6:40 AM, padmanabhan1616 wrote: >> Hi Team,We are using Apache SOLR-5.2.1 as index engine for our data >> analytics >> application. As part of this SOLR uses commons-fileupload-1.2.1.jar >> for file >> manipulation.There is security

Re: Apache commons fileupload migration

2018-03-20 Thread Shawn Heisey
On 3/15/2018 6:40 AM, padmanabhan1616 wrote: Hi Team,We are using Apache SOLR-5.2.1 as index engine for our data analytics application. As part of this SOLR uses commons-fileupload-1.2.1.jar for file manipulation.There is security Vulnerability identified in commons-fileupload library:

Re: Apache commons fileupload migration

2018-03-16 Thread padmanabhan1616
Yes I read the changelog 1.3.3. This release contains the security vulnerability fix. DiskDileItem can actually no longer be deserialized, *unless a system property is set to true*. Fixes FILEUPLOAD-279. We don't have security architecture for my product to decide weather it is vulnerable or

Re: Apache commons fileupload migration

2018-03-15 Thread Christopher Schultz
To whom it may concern, On 3/15/18 8:40 AM, padmanabhan1616 wrote: > Hi Team,We are using Apache SOLR-5.2.1 as index engine for our data analytics > application. As part of this SOLR uses commons-fileupload-1.2.1.jar for file > manipulation.There is security Vulnerability identified in >

Apache commons fileupload migration

2018-03-15 Thread padmanabhan1616
Hi Team,We are using Apache SOLR-5.2.1 as index engine for our data analytics application. As part of this SOLR uses commons-fileupload-1.2.1.jar for file manipulation.There is security Vulnerability identified in commons-fileupload library: *CVE-2016-131 Apache Commons FileUpload: