# \[IGN-6745\] Apache Commons Text vulnerability in Ignition? **URL:** \ **Category:** Ignition\ **Tags:** ignition81\ **Created:** [November 1, 2022, 8:41am UTC](https://forum.inductiveautomation.com/t/ign-6745-apache-commons-text-vulnerability-in-ignition/65920 "2022-11-01T08:41:47Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![indenkleefj](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/indenkleefj/32/10961_2.png) [@indenkleefj](https://forum.inductiveautomation.com/u/indenkleefj)\ **Post date:** [November 1, 2022, 8:41am UTC](https://forum.inductiveautomation.com/t/ign-6745-apache-commons-text-vulnerability-in-ignition/65920/1 "2022-11-01T08:41:47Z")
Hi, Does somebody have some background information about the vulnerability: [CVE - CVE-2022-42889](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42889) The Apache Commons Text 1.9 is also used in the latest (8.1.21) Ignition version. Is this vulnerability a big risk for Ignition? Some of our customers are getting worried about this vulnerability. I know the IA software department already has a ticket to fix this issue. But the customer is considering shutting down the Ignition server until this issue is fixed. But I'm not sure what to advise them. Could somebody give some more background on the impact of this vulnerability and Ignition? ---
**Author:** ![JordanCClark](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jordancclark/32/83362_2.png) [@JordanCClark](https://forum.inductiveautomation.com/u/JordanCClark)\ **Post date:** [November 1, 2022, 10:47am UTC](https://forum.inductiveautomation.com/t/ign-6745-apache-commons-text-vulnerability-in-ignition/65920/3 "2022-11-01T10:47:56Z")
From the Apache Commons website: - If you rely on software that uses a version of commons-text prior to 1.10.0, you are likely still not vulnerable: only if this software uses the `StringSubstitutor` API without properly sanitizing any untrusted input. [Commons Text – Apache Commons Text Security Reports](https://commons.apache.org/proper/commons-text/security.html) The closest that would come readily to mind is using QueryStrings in a named query, where you should always sanitze your inputs anyway. But, I don't know if it's using `StringSubstitutor` or not. EDIT: I updated the title to reflect which CVE we're talking about. ---
**Author:** ![kcollins](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kcollins/32/19646_2.png) [@kcollins](https://forum.inductiveautomation.com/u/kcollins)\ **Post date:** [November 1, 2022, 1:25pm UTC](https://forum.inductiveautomation.com/t/ign-6745-apache-commons-text-vulnerability-in-ignition/65920/4 "2022-11-01T13:25:35Z")
We reviewed this particular CVE earlier last month--there aren't any usages of the affected functions (`StringSubstitutor#createInterpolator` to be specific) within Ignition. ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [November 1, 2022, 1:36pm UTC](https://forum.inductiveautomation.com/t/ign-6745-apache-commons-text-vulnerability-in-ignition/65920/5 "2022-11-01T13:36:49Z")
It is probably worth making a public news item to that effect. ---
**Author:** ![rwilliams](https://avatars.discourse-cdn.com/v4/letter/r/74df32/32.png) [@rwilliams](https://forum.inductiveautomation.com/u/rwilliams)\ **Post date:** [November 4, 2022, 11:38pm UTC](https://forum.inductiveautomation.com/t/ign-6745-apache-commons-text-vulnerability-in-ignition/65920/6 "2022-11-04T23:38:10Z")
Please do. I have a client who discovered this vulnerability as well. I would like to provide them with information that is a little more official than a forum discussion. Thanks to everyone involved for this discussion, I would have had very little to tell our client without it. ---
**Author:** ![gabriel2](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/gabriel2/32/27208_2.png) [@gabriel2](https://forum.inductiveautomation.com/u/gabriel2)\ **Post date:** [November 10, 2022, 1:53pm UTC](https://forum.inductiveautomation.com/t/ign-6745-apache-commons-text-vulnerability-in-ignition/65920/7 "2022-11-10T13:53:52Z")
Do we have a public statement yet? ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [November 14, 2022, 5:36pm UTC](https://forum.inductiveautomation.com/t/ign-6745-apache-commons-text-vulnerability-in-ignition/65920/8 "2022-11-14T17:36:11Z")
> **[Regarding CVE-2022-42889 - Apache Commons Text](https://support.inductiveautomation.com/hc/en-us/articles/10621317982733)** > > On October 13th, 2022, a new vulnerability was published (CVE-2022-42889) against the Apache Commons Text library. This vulnerability could allow a remote attacker to execute malicious code on affe... ---
**Author:** ![rwilliams](https://avatars.discourse-cdn.com/v4/letter/r/74df32/32.png) [@rwilliams](https://forum.inductiveautomation.com/u/rwilliams)\ **Post date:** [March 13, 2023, 12:37pm UTC](https://forum.inductiveautomation.com/t/ign-6745-apache-commons-text-vulnerability-in-ignition/65920/9 "2023-03-13T12:37:54Z")
Was the fix implemented in an Ignition release? I saw it listed in one of the nightly updates. I would assume it has made it into the full releases by now, but can someone please verify that? My client continues to be concerned about this issue. I'll keep searching and post here if I find verification. ---
**Author:** ![lrose](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/lrose/32/62724_2.png) [@lrose](https://forum.inductiveautomation.com/u/lrose)\ **Post date:** [March 13, 2023, 12:47pm UTC](https://forum.inductiveautomation.com/t/ign-6745-apache-commons-text-vulnerability-in-ignition/65920/10 "2023-03-13T12:47:33Z")
See here: > [@Nightly 8.1 Changelogs - 2022](https://forum.inductiveautomation.com/t/nightly-8-1-changelogs-2022/54636/169): > > Weekly Changelog: 8.1.23-b20221115 Visualization 6399; Use ExampleProjectRenderer to render example project responses Fixed an issue where the project template combobox was not correctly using tooltips. 5748: Perspective Report Viewer: Empty String for 'source' causes an empty report to get stuck 'Initializing' indefinitely. Fixed an issue where Perspective's Report Viewer component could inadvertently generate "ghost" reports that would appear to be executing forever. Data Model 5055: Ca… V8.1.23+ is now dependent on Apache commons-text library version 1.10.0 which addresses the vulnerability. ---
**Author:** ![JordanCClark](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jordancclark/32/83362_2.png) [@JordanCClark](https://forum.inductiveautomation.com/u/JordanCClark)\ **Post date:** [March 13, 2023, 1:50pm UTC](https://forum.inductiveautomation.com/t/ign-6745-apache-commons-text-vulnerability-in-ignition/65920/11 "2023-03-13T13:50:59Z")
Also in the official release notes. > **[Ignition Release Notes for Version 8.1.23 | Inductive Automation](https://inductiveautomation.com/downloads/releasenotes/8.1.23)** > > Fixes, changes and features in Ignition 8.1.23 ---
**Author:** ![rwilliams](https://avatars.discourse-cdn.com/v4/letter/r/74df32/32.png) [@rwilliams](https://forum.inductiveautomation.com/u/rwilliams)\ **Post date:** [March 16, 2023, 9:43pm UTC](https://forum.inductiveautomation.com/t/ign-6745-apache-commons-text-vulnerability-in-ignition/65920/12 "2023-03-16T21:43:29Z")
Thank you. I was looking for first verification and then something I can pass on to our client to let them know the patch has now been installed in the regular monthly Ignition releases. That confirms that it went into a nightly updates, and it makes sense that it would be in the full 8.1.23 release after that. ---
**Author:** ![rwilliams](https://avatars.discourse-cdn.com/v4/letter/r/74df32/32.png) [@rwilliams](https://forum.inductiveautomation.com/u/rwilliams)\ **Post date:** [March 16, 2023, 9:44pm UTC](https://forum.inductiveautomation.com/t/ign-6745-apache-commons-text-vulnerability-in-ignition/65920/13 "2023-03-16T21:44:39Z")
That's the document I need to show that the ugrade is in the newer releases of Ignition (8.1.23+). Thank you.