Does somebody have some background information about the vulnerability: CVE - CVE-2022-42889
The Apache Commons Text 1.9 is also used in the latest (8.1.21) Ignition version.
Is this vulnerability a big risk for Ignition?
Some of our customers are getting worried about this vulnerability.
I know the IA software department already has a ticket to fix this issue.
But the customer is considering shutting down the Ignition server until this issue is fixed.
But I'm not sure what to advise them.
Could somebody give some more background on the impact of this vulnerability and Ignition?
If you rely on software that uses a version of commons-text prior to 1.10.0, you are likely still not vulnerable: only if this software uses the StringSubstitutor API without properly sanitizing any untrusted input. Commons Text – Apache Commons Text Security Reports
The closest that would come readily to mind is using QueryStrings in a named query, where you should always sanitze your inputs anyway. But, I don't know if it's using StringSubstitutor or not.
EDIT: I updated the title to reflect which CVE we're talking about.
Was the fix implemented in an Ignition release? I saw it listed in one of the nightly updates. I would assume it has made it into the full releases by now, but can someone please verify that? My client continues to be concerned about this issue.
I'll keep searching and post here if I find verification.
Thank you. I was looking for first verification and then something I can pass on to our client to let them know the patch has now been installed in the regular monthly Ignition releases. That confirms that it went into a nightly updates, and it makes sense that it would be in the full 8.1.23 release after that.