commons-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Phil Steitz (JIRA)" <j...@apache.org>
Subject [jira] [Closed] (DBCP-450) Veracode Static Analysis indicates SQL injection in Commons DBCP jar
Date Thu, 29 Oct 2015 21:57:27 GMT

     [ https://issues.apache.org/jira/browse/DBCP-450?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]

Phil Steitz closed DBCP-450.
----------------------------
    Resolution: Invalid

The SQL executed in these locations is either part of the implementation of the JDBC API or
core DBCP functionality.

> Veracode Static Analysis indicates SQL injection in Commons DBCP jar
> --------------------------------------------------------------------
>
>                 Key: DBCP-450
>                 URL: https://issues.apache.org/jira/browse/DBCP-450
>             Project: Commons Dbcp
>          Issue Type: Bug
>    Affects Versions: 2.0.1, 2.1.1
>            Reporter: I-Min Mau
>              Labels: security
>             Fix For: 2.2
>
>
> Veracode Static scan have indicated 3 High severity SQL injection flaws in this jar 
> Instances found via Static Scan
> Module # Class # Module Location Fix By Flaw Id
> 8 - commons-dbcp2-
> 2.1.1.jar
> .../DelegatingPreparedStatement.java 83 16477
> 9 - commons-dbcp2-
> 2.1.1.jar
> .../DelegatingStatement.java 291 16479
> 17 - commons-dbcp2-
> 2.1.1.jar
> .../PoolableConnectionFactory.java 325 16476



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

Mime
View raw message