US-CERT Releases Apache Struts Patch

US-CERT has released a security update regarding a vulnerability in Apache Struts versions 2.5 to 2.5.14. The Apache Software Foundation released Apache Security Bulletins S2-054 and S2-055, which respectively address CVE-2017-15707 and CVE-2017-7525.

The vulnerabilities could allow a remote, unauthenticated attacker to perform a denial-of-service (DOS) by submitting malicious JSON data. The vulnerable systems use an outdated JSON-lib library with the Struts REST plugin.

US-CERT encourages users and administrators to upgrade to Struts 2.5.14.1

• https://www.us-cert.gov/ncas/current-activity/2017/12/04/Apache-Software-Foundation-Releases-Security-Updates
• https://cwiki.apache.org/confluence/display/WW/S2-054
• https://cwiki.apache.org/confluence/display/WW/S2-055
• http://struts.apache.org/plugins/rest/