Mailing-List: contact dev-help@struts.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Struts Developers List" <dev@struts.apache.org>
Received-SPF: neutral (athena.apache.org: local policy)
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
  s=s1024; d=yahoo.ca;
  h=Received:X-Mailer:Date:From:Subject:To:MIME-Version:Content-Type:Content-Transfer-Encoding:Message-ID;
  b=Nu4JxGqWhKQkpNJS8nMIQWEjvyorNK7QgC1VXU+gGcdOYeObdoIfjVBrUBXXsEaI+oJUP9GVPy3EceOeyiopVVVMB0jQCiGQwjU9KKTTvTXJJoXcreiWadI83Sb/SUxfwdYmIZfm0k60XN4i9VE6I+xMrLigmvRuyOJ68LT/hRs=;
Date: Thu, 31 Jul 2008 06:31:05 -0700 (PDT)
From: Struts Two <strutstwo@yahoo.ca>
Subject: Re: [ANN] Struts 2.0.11.2 General Availability Release with Important
 Security Fix
To: Struts Developers List <dev@struts.apache.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable
Message-ID: <970687.23090.qm@web46104.mail.sp1.yahoo.com>

Any new on 2.0.12 release that would contain XWork 2.0.6 for Websphere user=
s?=0A=0A=0A=0A----- Original Message ----=0AFrom: Rene Gielen <rgielen@apac=
he.org>=0ATo: Struts Users Mailing List <user@struts.apache.org>=0ASent: We=
dnesday, July 16, 2008 2:40:38 AM=0ASubject: [ANN] Struts 2.0.11.2 General =
Availability Release with Important Security Fix=0A=0AApache Struts 2.0.11.=
2 is now available from=0A<http://struts.apache.org/download.cgi#struts2011=
2>.=0A=0AThis release is a fast track security fix release, including a sec=
urity=0Afixed version 2.0.5 of XWork, which corrects a serious vulnerabilit=
y in=0AParametersInterceptor allowing malicious users to remotely change se=
rver=0Aside context objects. For more information about the exploit, visit =
our=0Asecurity bulletins page at=0A<http://struts.apache.org/2.0.11.2/docs/=
s2-003.html>.=0A=0AIMPORTANT ADDITIONAL NOTES:=0AThere are two known issues=
 with this release:=0A1. the integrated XWork 2.0.5 jar may cause problems =
when used in a=0Acombination of WebSphere 6.1 runtime environments with val=
idation=0Aconfiguration via XML files.=0APossible Workarounds:=0A- use anno=
tation based validation definition instead XML based=0A- stay with Struts 2=
..0.11.1 including XWork 2.0.4, applying the=0A=A0 following exclude rule to=
 your parameter interceptor refs in=0A=A0 struts.xml=0A=A0 <interceptor-ref=
 name=3D"params">=0A=A0 =A0 =A0 <param name=3D"excludeParams">.*[[^\\p{Grap=
h}][\\\\#:=3D]].*</param>=0A=A0 </interceptor-ref>=0A2. the filtering mecha=
nism implemeted in XWork's ParametersInterceptor=0Ato fix the described sec=
urity issue does not completely avoid any=0Apossible malicious parameter na=
me.=0APossible Workaround:=0A- apply the following exclude rule to your par=
ameter interceptor refs in=0A=A0 struts.xml to avoid the usage of backslash=
 characters in parameter=0A=A0 names=0A=A0 <interceptor-ref name=3D"params"=
>=0A=A0 =A0 =A0 <param name=3D"excludeParams">.*\\.*</param>=0A=A0 </interc=
eptor-ref>=0ABoth issues will be addressed in a soon upcoming XWork 2.0.6 r=
elease,=0Afollowed by a new Struts 2.0 GA release including this new XWork =
version.=0A=0A* All developers are advised to either update Struts 2 applic=
ations to=0AStruts 2.0.11.2 or manually exchange usages of xwork-2.0.x.jar =
with the=0Afixed xwork-2.0.5.jar to prevent remotety induced context manipu=
lations.=0A=0AFor the complete release notes for Struts 2.0.11.2, see=0A<ht=
tp://struts.apache.org/2.0.11.2/docs/release-notes-20112.html>.=0A=0A=0A- T=
he Apache Struts Team.=0A=0A=0A=0A=0A=0A-----------------------------------=
----------------------------------=0ATo unsubscribe, e-mail: user-unsubscri=
be@struts.apache.org=0AFor additional commands, e-mail: user-help@struts.ap=
ache.org=0A=0A=0A      ____________________________________________________=
______________=0AGet a sneak peak at messages with a handy reading pane wit=
h All new Yahoo! Mail: http://ca.promos.yahoo.com/newmail/overview2/


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
For additional commands, e-mail: dev-help@struts.apache.org