- Announcements

- - -

- Apache Struts -
- Welcome -
- Downloads -
- Announcements -
- License -
- Thanks! -
- Sponsorship -
-
- Support -
- User Mailing List -
- Issue Tracker -
- Reporting Security Issues -
-
- Documentation -
- Birds Eye -
- Key Technologies -
- Kickstart FAQ -
- Wiki -
- Struts 2 -
- Struts 1 -
-
- Contributing -
- You at Struts -
- How to Help FAQ -
- Development Lists -
- Git for Struts -
- Troubleshooting Git-Svn -
- Source Code -
- Release Guidelines -
- PMC Charter -
- Volunteers -
- Source Repository -
-

- - - - -

- -

+ + + + + + + + + Announcements 2011 + + + + + + + + + + + +

+ + +

+ + + +

+ +

- -

- - -

- - - - - -

Announcements

- Skip to: Announcements - 2010 -

25 December 2011 - Struts 2.3.1.1 General Availability Release

- The Apache Struts group is pleased to announce that Struts 2.3.1.1 is - available as a "General Availability" release. The GA designation is our - highest quality grade. -

- Apache Struts 2 is an elegant, extensible framework for creating - enterprise-ready Java web applications. The framework is designed to - streamline the full development cycle, from building, to deploying, to - maintaining applications over time. -

- An important vulnerability were solved with this release: -

- Remote command execution and arbitrary file overwrite -
- Strict DMI mode does not work correctly -

- -

- All developers are strongly advised to update existing Struts 2 applications - to Struts 2.3.1.1. -

- Struts 2.3.1.1 is available in a full distribution, - or as separate library, source, example and documentation - distributions, from the - releases page. - The release is also available through the central Maven repository under Group ID - "org.apache.struts". The - release notes - are available online. -

- The 2.3.x series of the Apache Struts framework has a minimum - requirement of the following specification versions: Servlet API 2.4, - JSP API 2.0, and Java 5. -

- Should any issues arise with your use of any version of the Struts - framework, please post your comments to the user list, and, if - appropriate, file a tracking ticket. -

- -

18 December 2011 - Struts 2.0.14 End of Life Announcement

- The Apache Struts Team likes to inform you that the Struts 2.0 branch has reached it's end of life - and is no longer supported. All users of Struts 2.0.14 or earlier Struts 2 versions are strongly - advised to update their existing applications to Struts 2.3.x. -

- Struts 2.0.14 was for some time maintained in parallel to the 2.1 and 2.2 branches, since Struts 2.1 - introduced some API and plugin changes that were likely to break existing user code on top of Struts 2. - However, the community interest in maintaining the Struts 2.0.x branch was not strong enough to - keep it sufficiently up to date, especially in terms of security fixes. There are several serious - security problems that, while being continuously addressed in later Struts 2 versions, did not make - it into the 2.0.x branch. For that reason the Apache Struts PMC decided to remove 2.0.14 as a supported - version. -

- For more information on how to upgrade existing applications running on top of Struts 2.0.x to - Struts 2.1 and later, please read the - - Guide to migrating from Struts 2.0.x to 2.1.x. -

- - -

12 December 2011 - Struts 2.3.1 General Availability Release

- The Apache Struts group is pleased to announce that Struts 2.3.1 is - available as a "General Availability" release. The GA designation is our - highest quality grade. -

- Some new futures are: -

- New Portlet 2.0 (JSR 286) plugin replaced the Portlet 1.0 (JSR 168) plugin -
- New CDI plugin was added to allow use CDI (JavaEE 6) as an Object Factory in Struts 2 -
- The dependencies of the Struts2-Spring plugin were upgraded from Spring 2.5 to 3.0 -

- Besides that, various other bug fixes, improvements and security enhancements have been incorporated. - -

- All developers are strongly advised to update existing Struts 2 applications - to Struts 2.3.1. -

- Struts 2.3.1 is available in a full distribution, - or as separate library, source, example and documentation - distributions, from the - releases page. - The release is also available through the central Maven repository under Group ID - "org.apache.struts". The - release notes - are available online. -

- The 2.3.x series of the Apache Struts framework has a minimum - requirement of the following specification versions: Servlet API 2.4, - JSP API 2.0, and Java 5. -

- Should any issues arise with your use of any version of the Struts - framework, please post your comments to the user list, and, if - appropriate, file a tracking ticket. -

- -

7 September 2011 - Struts 2.2.3.1 General Availability Release

- The Apache Struts group is pleased to announce that Struts 2.2.3.1 is - available as a "General Availability" release. The GA designation is our - highest quality grade. -

- An important vulnerability were solved with this release: -

- User input was evaluated as an OGNL expression when there's a conversion error. -

- -

- All developers are strongly advised to update existing Struts 2 applications - to Struts 2.2.3.1. -

- Struts 2.2.3.1 is available in a full distribution, - or as separate library, source, example and documentation - distributions, from the - releases page. - The release is also available through the central Maven repository under Group ID - "org.apache.struts". The - release notes - are available online. -

- The 2.2.x series of the Apache Struts framework has a minimum - requirement of the following specification versions: Servlet API 2.4, - JSP API 2.0, and Java 5. -

- Should any issues arise with your use of any version of the Struts - framework, please post your comments to the user list, and, if - appropriate, file a tracking ticket. -

- Skip to: Announcements - 2010 -

- -

- Next: - Kickstart FAQ -

- - - -

- -

- - - + + Modified: websites/production/struts/content/announce-2012.html ============================================================================== --- websites/production/struts/content/announce-2012.html (original) +++ websites/production/struts/content/announce-2012.html Fri Feb 21 07:29:33 2014 @@ -1,509 +1,407 @@ - - - - - - - - - Announcements - - - - - - - - - - - - - - - - - -

- - - - - - -

- - -

- Apache Struts -
- Welcome -
- Downloads -
- Announcements -
- License -
- Thanks! -
- Sponsorship -
-
- Support -
- User Mailing List -
- Issue Tracker -
- Reporting Security Issues -
-
- Documentation -
- Birds Eye -
- Key Technologies -
- Kickstart FAQ -
- Wiki -
- Struts 2 -
- Struts 1 -
-
- Contributing -
- You at Struts -
- How to Help FAQ -
- Development Lists -
- Git for Struts -
- Troubleshooting Git-Svn -
- Source Code -
- Release Guidelines -
- PMC Charter -
- Volunteers -
- Source Repository -
-

- - - - -

- -

+ + + + + + + + + Announcements 2012 + + + + + + + + + + + +

+ + +

+ + + +

+ +

- -

- - -

- - - - - -

Announcements

- Skip to: - Announcements - 2011 -

- -

22 December 2012 - Struts 2.3.8 General Availability Release

- The Apache Struts group is pleased to announce that Struts 2.3.8 is - available as a "General Availability" release. The GA designation is our - highest quality grade. -

- It's a mostly maintenance release which improves overall performance which should be significant - better than in version 2.3.7 and slightly better than in version 2.3.4.1. This version depends on new OGNL - version 3.0.6 - thanks to Pelladi Gabor and Johno Crawford for their contribution! - Please check the Version Notes to see more details. -

- All developers are strongly advised to update existing Struts 2 applications - to Struts 2.3.8. -

- Struts 2.3.8 is available in a full distribution or as separate library, source, example and documentation - distributions, from the - releases page. - The release is also available through the central Maven repository under Group ID "org.apache.struts". The - release notes - are available online. -

- The 2.3.x series of the Apache Struts framework has a minimum - requirement of the following specification versions: Servlet API 2.4, - JSP API 2.0, and Java 5. -

- Should any issues arise with your use of any version of the Struts - framework, please post your comments to the user list, and, if - appropriate, file a tracking ticket. -

- -

19 November 2012 - Struts 2.3.7 General Availability Release

- The Apache Struts group is pleased to announce that Struts 2.3.7 is - available as a "General Availability" release. The GA designation is our - highest quality grade. -

- It's a mostly maintenance release where many bugs were solved and many improvements were added. - Please check the Version Notes to see more details, also performance was improved. -

- All developers are strongly advised to update existing Struts 2 applications - to Struts 2.3.7. -

- Struts 2.3.7 is available in a full distribution, - or as separate library, source, example and documentation - distributions, from the - releases page. - The release is also available through the central Maven repository under Group ID - "org.apache.struts". The - release notes - are available online. -

- The 2.3.x series of the Apache Struts framework has a minimum - requirement of the following specification versions: Servlet API 2.4, - JSP API 2.0, and Java 5. -

- Should any issues arise with your use of any version of the Struts - framework, please post your comments to the user list, and, if - appropriate, file a tracking ticket. -

- -

13 August 2012 - Struts 2.3.4.1 General Availability Release

- The Apache Struts group is pleased to announce that Struts 2.3.4.1 is - available as a "General Availability" release. The GA designation is our - highest quality grade. -

- Two security issues were solved with this release: -

- Decoupling of session attribute and parameter naming for Struts 2 token mechanism, - to improve security when used for CSRF-attack protection -
- Parameter name length is now by default restricted to 100 characters to diminish possible DOS - attack effectiveness -

- -

- All developers are strongly advised to update existing Struts 2 applications - to Struts 2.3.4.1. -

- Struts 2.3.4.1 is available in a full distribution, - or as separate library, source, example and documentation - distributions, from the - releases page. - The release is also available through the central Maven repository under Group ID - "org.apache.struts". The - release notes - and the - token mechanism security bulletin - as well as the - parameter name length security bulletin - are available online. -

- The 2.3.x series of the Apache Struts framework has a minimum - requirement of the following specification versions: Servlet API 2.4, - JSP API 2.0, and Java 5. -

- Should any issues arise with your use of any version of the Struts - framework, please post your comments to the user list, and, if - appropriate, file a tracking ticket. -

- -

12 May 2012 - Struts 2.3.4 General Availability Release

- The Apache Struts group is pleased to announce that Struts 2.3.4 is - available as a "General Availability" release. The GA designation is our - highest quality grade. -

- It's a mostly maintenance release where many bugs were solved and many improvements were added. - Please check the Version Notes to see more details. -

- All developers are strongly advised to update existing Struts 2 applications - to Struts 2.3.4. -

- Struts 2.3.4 is available in a full distribution, or as separate library, source, - example and documentation distributions, from the - releases page. - The release is also available through the central Maven repository under Group ID - "org.apache.struts". The - version notes - are available online. -

- The 2.3.x series of the Apache Struts framework has a minimum - requirement of the following specification versions: Servlet API 2.4, - JSP API 2.0, and Java 5. -

- Should any issues arise with your use of any version of the Struts - framework, please post your comments to the user list, and, if - appropriate, file a tracking ticket. -

- -

16 April 2012 - Struts 2.3.3 General Availability Release

- The Apache Struts group is pleased to announce that Struts 2.3.3 is - available as a "General Availability" release. The GA designation is our - highest quality grade. -

- It's a mostly maintenance release where many bugs were solved and many improvements were added. - Please check the Version Notes to see more details. -

- All developers are strongly advised to update existing Struts 2 applications - to Struts 2.3.3. -

- Struts 2.3.3 is available in a full distribution, or as separate library, source, - example and documentation distributions, from the - releases page. - The release is also available through the central Maven repository under Group ID - "org.apache.struts". The - version notes - are available online. -

- The 2.3.x series of the Apache Struts framework has a minimum - requirement of the following specification versions: Servlet API 2.4, - JSP API 2.0, and Java 5. -

- Should any issues arise with your use of any version of the Struts - framework, please post your comments to the user list, and, if - appropriate, file a tracking ticket. -

- -

22 January 2012 - Struts 2.3.1.2 General Availability Release

- The Apache Struts group is pleased to announce that Struts 2.3.1.2 is - available as a "General Availability" release. The GA designation is our - highest quality grade. -

- An important vulnerability were solved with this release: -

- ParameterInterceptor vulnerability allowed remote command execution -
- Default acceptedParamNames has been updated to more restrictive values -

- -

- All developers are strongly advised to update existing Struts 2 applications - to Struts 2.3.1.2. -

- Struts 2.3.1.2 is available in a full distribution, - or as separate library, source, example and documentation - distributions, from the - releases page. - The release is also available through the central Maven repository under Group ID - "org.apache.struts". The - release notes - and the - security bulletin - are available online. -

- The 2.3.x series of the Apache Struts framework has a minimum - requirement of the following specification versions: Servlet API 2.4, - JSP API 2.0, and Java 5. -

- Should any issues arise with your use of any version of the Struts - framework, please post your comments to the user list, and, if - appropriate, file a tracking ticket. -

- Skip to: - Announcements - 2011 -

- -

- Next: - Kickstart FAQ -

- - - -

- -

- - - + +