Grouper Users - Open Discussion List

["Bryan E. Wooten" <>]

Thanks Chris.

-Bryan

From: Chris Hyzer <>
Date: Monday, April 28, 2014 12:23 PM
To: Bryan Wooten <>, "" <>
Subject: RE: Struts exploit?

We don’t use struts 2.  In Grouper 2.3 hopefully we wont use struts anymore at all…

 

From: [] On Behalf Of Bryan E. Wooten
Sent: Monday, April 28, 2014 2:21 PM
To:
Subject: [grouper-users] Struts exploit?

 

So we get an email from our CISO about this: http://struts.apache.org/announce.html#a20140424

 

“24 April 2014 - Struts up to 2.3.16.1: Zero-Day Exploit Mitigation

In Struts 2.3.16.1, an issue with ClassLoader manipulation via request parameters was supposed to be resolved. Unfortunately, the correction wasn't sufficient.

A security fix release fully addressing this issue is in preparation and will be released as soon as possible.

Once the release is available, all Struts 2 users are strongly recommended to update their installations.”

I see that Grouper UI uses Struts. Is this an issue I need to worry about?

 

-Bryan