oss-sec mailing list archives
Re: CVE-2022-47501: Apache OFBiz: Arbitrary file reading vulnerability
From: Seth Arnold <seth.arnold () canonical com>
Date: Tue, 18 Apr 2023 01:27:52 +0000
On Mon, Apr 10, 2023 at 09:21:11AM +0000, Jacques Le Roux wrote:
https://lists.apache.org/list.html?announce () apache org https://ofbiz.apache.org/download.html https://ofbiz.apache.org/security.html https://ofbiz.apache.org/ https://www.cve.org/CVERecord?id=CVE-2022-47501
Hello Jacques, thanks for contacting the oss-security mail list about this security issue in an Apache project. I'd like to suggest that your email would be far more useful if it included some details like affected versions: ideally, when a vulnerability was introduced, and definitely, when it was fixed, if a fix is available. Best would be a direct link to a patch in a source control system, or attaching the patch directly. This particular email has very few details and no references for a fix so it is very difficult for anyone to take concrete actions. Here's two recent postings that are far easier for downstream distributors and consumers alike to use: https://www.openwall.com/lists/oss-security/2023/04/04/1 https://www.openwall.com/lists/oss-security/2023/03/21/3 I'd like to encourage Apache to use these as inspiration for future oss-security postings. Thanks
Attachment:
signature.asc
Description:
Current thread:
- CVE-2022-47501: Apache OFBiz: Arbitrary file reading vulnerability Jacques Le Roux (Apr 10)
- Re: CVE-2022-47501: Apache OFBiz: Arbitrary file reading vulnerability Seth Arnold (Apr 17)
- Re: CVE-2022-47501: Apache OFBiz: Arbitrary file reading vulnerability Jacques Le Roux (Apr 18)
- Re: CVE-2022-47501: Apache OFBiz: Arbitrary file reading vulnerability Seth Arnold (Apr 18)
- Re: CVE-2022-47501: Apache OFBiz: Arbitrary file reading vulnerability Jacques Le Roux (Apr 19)
- Re: CVE-2022-47501: Apache OFBiz: Arbitrary file reading vulnerability Jacques Le Roux (Apr 18)
- Re: CVE-2022-47501: Apache OFBiz: Arbitrary file reading vulnerability Seth Arnold (Apr 17)