struts-user mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Lukasz Lenart <>
Subject [ANN] [SECURITY] Struts Extras secure Multipart plugins GA - versions 1.1
Date Thu, 23 Mar 2017 08:19:26 GMT
The Apache Struts group is pleased to announce that the Apache Struts
2 Secure Jakarta Multipart parser plugin 1.1 and Apache Struts 2
Secure Jakarta Stream Multipart parser plugin 1.1 are available as a
“General Availability” release. The GA designation is our highest
quality grade.

These releases address one critical security vulnerability:

- Possible Remote Code Execution when performing file upload based on
Jakarta Multipart parser S2-045, S2-046 (CVE-2017-5638)

Also backward comaptibility between different Struts versions was improved.

Those plugins were released to allow users running older versions of
the Apache Struts secure their applications in easy way. You don’t
have to migrate to the latest version (which is still preferable) but
by applying one of those plugins, your application won’t be vulnerable

Please read the README ( for
more details and supported Apache Struts versions.

All developers are strongly advised to perform this action.

Should any issues arise with your use of any version of the Struts
framework, please post your comments to the user list, and, if
appropriate, file a tracking ticket.

You can download those plugins from our download page.

+ 48 606 323 122

To unsubscribe, e-mail:
For additional commands, e-mail:

View raw message