oss-security - Re: CVE-2022-47501: Apache OFBiz: Arbitrary file reading vulnerability

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20230418012752.GI1655348@millbarge>
Date: Tue, 18 Apr 2023 01:27:52 +0000
From: Seth Arnold <seth.arnold@...onical.com>
To: Jacques Le Roux <jleroux@...che.org>
Cc: oss-security@...ts.openwall.com
Subject: Re: CVE-2022-47501: Apache OFBiz: Arbitrary file
 reading vulnerability

On Mon, Apr 10, 2023 at 09:21:11AM +0000, Jacques Le Roux wrote:
> https://lists.apache.org/list.html?announce@apache.org
> https://ofbiz.apache.org/download.html
> https://ofbiz.apache.org/security.html
> https://ofbiz.apache.org/
> https://www.cve.org/CVERecord?id=CVE-2022-47501

Hello Jacques, thanks for contacting the oss-security mail list about this
security issue in an Apache project.

I'd like to suggest that your email would be far more useful if
it included some details like affected versions: ideally, when a
vulnerability was introduced, and definitely, when it was fixed, if a
fix is available. Best would be a direct link to a patch in a source
control system, or attaching the patch directly.

This particular email has very few details and no references for a fix so
it is very difficult for anyone to take concrete actions.

Here's two recent postings that are far easier for downstream distributors
and consumers alike to use:
https://www.openwall.com/lists/oss-security/2023/04/04/1
https://www.openwall.com/lists/oss-security/2023/03/21/3

I'd like to encourage Apache to use these as inspiration for future
oss-security postings.

Thanks

Download attachment "signature.asc" of type "application/pgp-signature" (489 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.