Fix for CVE2011-2196 for Seam 2.2.x Community Edititon

[eddykaya]

Hello everybody,

I just looked for a fix of the CVE issue 2011-2196 in the public Git repository but I couldn't find one there but for the CVE 2011-1484. What I need is a patch for the newer CVE issue 2011-2196. Does anybody know where I can find a fix? Has this issue ever been fixed in the community edition?

Thanks for your help,

Eddy

[manarh]

CVE 2011-1484 was fixed in https://sourceforge.net/projects/jboss/files/JBoss%20Seam/2.2.2.Final

CVE 2011-2196 was fixed in Seam 2: 2.3.0.ALPHA this version is still using JSF 1.2 so you can go with that if you need to stick with JSF 1, the 2.3.0.ALPHA is just mavenized 2.2.2.Final and a bunch of fixes.

[manarh]

FYI Download is here http://sourceforge.net/projects/jboss/files/JBoss%20Seam/2.3.0.ALPHA/

[eddykaya]

Hello Marek,

thanks for your reply. I couldn't find any hint in the changelog for that fix or a JBSEAM ticket for that.

What I like to do is fix our current version 2.2.0, however I cannot find a commit in the git repository. Would you please provide some information which commit number that was or at least who fixed that issue?

Thanks in advance,

Eddy

[manarh]

It is in Release notes -  Release Notes - JBoss Issue Tracker

The related issues are:

1. [#JBSEAM-4844] Seam 2 does not properly block access to EL expressions - JBoss Issue Tracker
2. [#JBSEAM-4816] NullPointerException in EL Expression evaluation - JBoss Issue Tracker

You should apply commits:

1. https://github.com/seam2/jboss-seam/commit/8c67a2a57a5432b80c1f49093255ed3edb955feb
2. https://github.com/seam2/jboss-seam/commit/703be98a1c77479838b8b8821a4a437ba0d664d0

[eddykaya]

Thanks alot!