[lyo-dev] CVE-2023-22665: Apache Jena: Exposure of arbitrary execution i

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [List Home]

[lyo-dev] CVE-2023-22665: Apache Jena: Exposure of arbitrary execution in script engine expressions.

From: Andrii Berezovskyi <andriib@xxxxxx>
Date: Thu, 27 Apr 2023 08:46:06 +0000
Accept-language: en-GB, en-US, sv-SE
Delivered-to: lyo-dev@xxxxxxxxxxx
Dkim-filter: OpenDKIM Filter v2.11.0 smtp-relay-2.sys.kth.se 4Q6Tq235kgzPMfB
List-archive: <https://www.eclipse.org/mailman/private/lyo-dev/>
List-help: <mailto:lyo-dev-request@eclipse.org?subject=help>
List-subscribe: <https://www.eclipse.org/mailman/listinfo/lyo-dev>, <mailto:lyo-dev-request@eclipse.org?subject=subscribe>
List-unsubscribe: <https://www.eclipse.org/mailman/options/lyo-dev>, <mailto:lyo-dev-request@eclipse.org?subject=unsubscribe>
Thread-index: AQHZeOS0h6fUvnWv60Od7ZDan6S3BQ==
Thread-topic: CVE-2023-22665: Apache Jena: Exposure of arbitrary execution in script engine expressions.

Hi,

https://lists.apache.org/thread/s0dmpsxcwqs57l4qfs415klkgmhdxq7s announces quite a severe CVE. It shouldn’t affect you if you use Lyo to process OSLC Query statements and convert them to prepared SPARQL statements and instead all SPARQL queries to be submitted directly.

–Andrew

Follow-Ups:
- Re: [lyo-dev] CVE-2023-22665: Apache Jena: Exposure of arbitrary execution in script engine expressions.
  - From: Andrii Berezovskyi
- Re: [lyo-dev] CVE-2023-22665: Apache Jena: Exposure of arbitrary execution in script engine expressions.
  - From: Jad El-Khoury

Prev by Date: Re: [lyo-dev] [eclipse.org-committers] Reminder: wiki.eclipse.org will be shutdown in 2026
Next by Date: Re: [lyo-dev] CVE-2023-22665: Apache Jena: Exposure of arbitrary execution in script engine expressions.
Previous by thread: [lyo-dev] Fwd: Bumps in the road(map)
Next by thread: Re: [lyo-dev] CVE-2023-22665: Apache Jena: Exposure of arbitrary execution in script engine expressions.
Index(es):
- Date
- Thread

Breadcrumbs