Aquileo | Recent changes to patches

Aquileo | #38 YAJSW v13.x: commons-lang3 & commons-lang vulnerability

Thu, 25 Sep 2025 09:18:15 -0000

thanks for pointing this out.
something went wrong during the packing of the zip file.

release 13.17

Aquileo | #39 Netty* v4.1.118 vulnerability

Thu, 25 Sep 2025 09:16:36 -0000

status: open --> closed-fixed

Aquileo | #38 YAJSW v13.x: commons-lang3 & commons-lang vulnerability

Tue, 23 Sep 2025 19:22:55 -0000

Hi rzo -

Thank you for patching for v13.x. I unzipped release v13.16 but these two libs are not patched still:

inflating: yajsw-stable-13.16/lib/core/commons/commons-lang-2.6.jar
inflating: yajsw-stable-13.16/lib/core/commons/commons-lang3-3.12.0.jar

Thank you agian.

Aquileo | #39 Netty* v4.1.118 vulnerability

Tue, 23 Sep 2025 09:30:04 -0000

https://nvd.nist.gov/vuln/detail/CVE-2025-55163
https://nvd.nist.gov/vuln/detail/CVE-2025-58056
https://nvd.nist.gov/vuln/detail/CVE-2025-58057

Aquileo | Netty* v4.1.118 vulnerability

Tue, 23 Sep 2025 09:22:25 -0000

Details of the Issue
CVE ID: CVE-2025-58057, CVE-2025-58056
Affected Yajsw Version:13.5
Vulnerable Dependency: netty* v4.1.118
Impact:
https://nvd.nist.gov/vuln/detail/CVE-2025-58056
https://nvd.nist.gov/vuln/detail/CVE-2025-58057

Aquileo | Netty* v4.1.118 vulnerability

Tue, 23 Sep 2025 09:22:25 -0000

Ticket 39 has been modified: Netty* v4.1.118 vulnerability
Edited By: rzo (rzorzorzo)
Status updated: 'open' => 'closed-fixed'

Aquileo | #36 netty-common-4.1.114.Final vulnerability

Fri, 19 Sep 2025 07:04:28 -0000

status: open-accepted --> closed-fixed

Aquileo | #37 commons-vfs2-2.9.0.jar Vulnerabilities

Fri, 19 Sep 2025 07:03:37 -0000

status: open-accepted --> closed-fixed

Aquileo | #38 YAJSW v13.x: commons-lang3 & commons-lang vulnerability

Fri, 19 Sep 2025 07:01:51 -0000

status: open --> closed-fixed

Aquileo | YAJSW v13.x: commons-lang3 & commons-lang vulnerability

Tue, 26 Aug 2025 17:57:04 -0000

JRE8 continues to roll in patches so we haven't been able to move away from it.
Would you please continue to patch 3rd party libs used in yajsw v13.x?

CVE-2025-48924 have been issued for:
1. commons-lang3-3.12.0.jar vulnerability
2. commons-lang-2.6.jar vulnerability

Found with: yajsw v13.15 :
- yajsw\lib\core\commons\commons-lang3-3.12.0.jar
- yajsw\lib\core\commons\commons-lang-2.6.jar

Whitesource (Mend) Scan as of 8/26/2025:
CVE-2025-48924
CVSS 3 Score: 5.3 (Severity: Medium)
"Uncontrolled Recursion vulnerability in Apache Commons Lang. This issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0. The methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a StackOverflowError could cause an application to stop. Users are recommended to upgrade to version 3.18.0, which fixes the issue."