Re: [ANN][SECURITY] Struts 1 - CVE-2014-0114 -Mitigation Advice Available, Possible RCE Impact

2014-05-01 Thread Eric Reed
Rene, Thank you for your insight and advice. I have successfully secured 5 production applications with proof of concept before and after and have re-deployed these critical applications in under 4 hours with very little down time. Best Regards, Eric >>> Rene Gielen 5/1/2014 2:59 PM >>> As c

[ANN][SECURITY] Struts 1 - CVE-2014-0114 -Mitigation Advice Available, Possible RCE Impact

2014-05-01 Thread Rene Gielen
As confirmed in our last announcement, the Apache Struts 1 framework in all versions is affected by a ClassLoader manipulation vulnerability (CVE-2014-0114) similar to a recently fixed vulnerability in Struts 2 (CVE-2014-0112, CVE-2014-0094) [1]. Thanks to the efforts of Alvaro Munoz and the HP Fo