Re: [codec] Questions for Apache Commons Codec information disclosure
It might be https://issues.apache.org/jira/browse/CODEC-134 Gary On Tue, Sep 22, 2020 at 11:19 AM De Zhi Mou wrote: > Hi, > > Our product received this vulnerability, apache-commons-codec-info-disc > (177835). > In the advisory references, there is a link to > https://www.whitesourcesoftware.com/vulnerability-database/WS-2019-0379 > which says Apache commons-codec before version “commons-codec-1.13-RC1” is > vulnerable to information disclosure due to Improper Input validation. > > We want to know what kind of improper input validation would cause the > vulnerability. I look through all the references but cannot get that > information. Are there any examples or testing codes? > We do not directly use codec in our product, but we use HttpClient, which > requires codec. Are we still vulnerable or not in this case? > > Really appreciate for your help. Thanks. > > > Regards, > Paul > --- > Paul ( DeZhi Mou, 牟德志) > ClearQuest/Traxiem Software Engineer > HCL Software > > ::DISCLAIMER:: > > The contents of this e-mail and any attachment(s) are confidential and > intended for the named recipient(s) only. E-mail transmission is not > guaranteed to be secure or error-free as information could be intercepted, > corrupted, lost, destroyed, arrive late or incomplete, or may contain > viruses in transmission. The e mail and its contents (with or without > referred errors) shall therefore not attach any liability on the originator > or HCL or its affiliates. Views or opinions, if any, presented in this > email are solely those of the author and may not necessarily reflect the > views or opinions of HCL or its affiliates. Any form of reproduction, > dissemination, copying, disclosure, modification, distribution and / or > publication of this message without the prior written consent of authorized > representative of HCL is strictly prohibited. If you have received this > email in error please delete it and notify the sender immediately. Before > opening any email and/or attachments, please check them for viruses and > other defects. > >
[codec] Questions for Apache Commons Codec information disclosure
Hi, Our product received this vulnerability, apache-commons-codec-info-disc (177835). In the advisory references, there is a link to https://www.whitesourcesoftware.com/vulnerability-database/WS-2019-0379 which says Apache commons-codec before version “commons-codec-1.13-RC1” is vulnerable to information disclosure due to Improper Input validation. We want to know what kind of improper input validation would cause the vulnerability. I look through all the references but cannot get that information. Are there any examples or testing codes? We do not directly use codec in our product, but we use HttpClient, which requires codec. Are we still vulnerable or not in this case? Really appreciate for your help. Thanks. Regards, Paul --- Paul ( DeZhi Mou, 牟德志) ClearQuest/Traxiem Software Engineer HCL Software ::DISCLAIMER:: The contents of this e-mail and any attachment(s) are confidential and intended for the named recipient(s) only. E-mail transmission is not guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or may contain viruses in transmission. The e mail and its contents (with or without referred errors) shall therefore not attach any liability on the originator or HCL or its affiliates. Views or opinions, if any, presented in this email are solely those of the author and may not necessarily reflect the views or opinions of HCL or its affiliates. Any form of reproduction, dissemination, copying, disclosure, modification, distribution and / or publication of this message without the prior written consent of authorized representative of HCL is strictly prohibited. If you have received this email in error please delete it and notify the sender immediately. Before opening any email and/or attachments, please check them for viruses and other defects.
[net] Telnet connection to over SSL via Port forwarding proxy
I have a need to connect to a server via telnet via a proxy:
Here is my code:
TelnetClient telnet;
telnet = new TelnetClient();
SSLSocketFactory sslsocketfactory = (SSLSocketFactory)
SSLSocketFactory.getDefault();
telnet.setSocketFactory(sslsocketfactory);
Proxy socksProxy = new Proxy(Proxy.Type.SOCKS, new
InetSocketAddress("127.0.0.1", 6600));
telnet.setProxy(socksProxy);
telnet.connect(host, port);
When I run this code, no errors are thrown, but the reader thread blocks. When
I debug the program, I noticed that the Telnet negotiation did not fire.
When I debugged a little further, I noticed that when I set the proxy, the code
in SocketClient.setProxy() resets the socket client.
I downloaded the Apache code and commented out the line
/**
* Sets the proxy for use with all the connections.
* The proxy is used for connections established after the
* call to this method.
*
* @param proxy the new proxy for connections.
* @since 3.2
*/
public void setProxy(Proxy proxy) {
// setSocketFactory(new DefaultSocketFactory(proxy));
connProxy = proxy;
}
My code then works.
Is this a bug, or am I using the TelnetClient incorrectly?
Regards John Holliday
This E-Mail is intended only for the addressee. Its use is limited to that
intended by the author at the time and it is not to be distributed without the
author's consent. Unless otherwise stated, the State of Queensland accepts no
liability for the contents of this E-Mail except where subsequently confirmed
in writing. The opinions expressed in this E-Mail are those of the author and
do not necessarily represent the views of the State of Queensland. This E-Mail
is confidential and may be subject to a claim of legal privilege. If you have
received this E-Mail in error, please notify the author and delete this message
immediately.
