Create
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Sign up Log in
Products
See all
Community resources
Interests
See all
Community resources
Top groups
Explore all groups
Community resources
Celebration

Earn badges and make progress

You're on your way to the next level! Join the Kudos program to earn points and save your progress.

Deleted user Avatar
Deleted user

Level 1: Seed

25 / 150 points

Next: Root

Avatar

1 badge earned

Collect

Participate in fun challenges

Challenges come and go, but your rewards stay with you. Do more to earn more!

Challenges
Coins

Gift kudos to your peers

What goes around comes around! Share the love by gifting kudos to your peers.

Recognition
Ribbon

Rise up in the ranks

Keep earning points to reach the top of the leaderboard. It resets every quarter so you always have a chance!

Leaderboard

Join now to unlock these features and more

Come for the products,
stay for the community

The Atlassian Community can help you and your team get more value out of Atlassian products and practices.

Get started Tell me more
Atlassian Community about banner
4,465,096
Community Members
 
Community Events
176
Community Groups

CVE-2017-9805, Is there a fix/patch available?

John_Sewchand
John_Sewchand Sep 06, 2017

A struts-2 security alert has been raised, CVE-2017-9805.  I've noticed that the version of Crowd that we are using, 2.11.1, has the affected struts libraries within the installation.  Do the newer versions use later, unaffected versions of struts-2 and if not, is there a patch available?  If none is available is there an eta for a version that is not affected?

Much appreciated

Answer
Watch
Like Be the first to like this
993 views

1 answer

1 accepted

1 vote
Answer accepted
Marcin Kempa
Marcin Kempa Atlassian Team Sep 06, 2017 • edited

Hi @John_Sewchand,

The CVE-2017-9805 is not in struts core, but in the rest plugin, which is not used in Crowd (also not in 2.11.1). Therefore Crowd is not affected by this vulnerability.

Please see the https://jira.atlassian.com/browse/CWD-4971 andhttps://twitter.com/JIRA/status/905486179901906944 for further information.

 

Best Regards,

Marcin Kempa

View More Comments
John_Sewchand
John_Sewchand Sep 06, 2017

Thanks for the quick reply!

Like
Reply

Suggest an answer

Log in or Sign up to answer
Crowd
Crowd
TAGS

Atlassian Community Events

See all events