<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"></head><body>
<div>I certainly hope you are right. Though I believe the version you listed is the RedHat package, not the one in the jpackage repo that the install documents indicate. That is struts-1.3.8-2.jpp5.noarch. That version already pops in 3 different scanner products for other vulnerabilities.</div><div><br></div><div><br></div><div><br></div><div id="composer_signature"><div style="font-size:88%;color:#364f67" dir="auto">Happy Connecting. Sent from my Sprint Samsung Galaxy S® 5 Sport</div></div><br><br>-------- Original message --------<br>From: Avi Miller <avi.miller@oracle.com> <br>Date: 3/8/17 12:35 PM (GMT-07:00) <br>To: spacewalk-list@redhat.com <br>Subject: Re: [Spacewalk-list] Spacewalk Possible Remote Code Exploit Heads Up <br><br>Hi,<br><br>The CVE is applicable to struts2, while the version from JPackage is struts-1.3.10-12.el7.noarch. I’m assuming (hoping) that it’s actually too old to be vulnerable.<br><br>Cheers,<br>Avi<br><br>> On 9 Mar 2017, at 5:49 am, Eric <ericb@enrsystems.com> wrote:<br>> <br>> CVE-2017-5638<br>> <br>> Struts. Our struts package is from the Generic Jpackage repository. The <br>> struts rpm there has not been maintained for years. The current build <br>> directions point at that repository, so I believe that makes ALL current <br>> versions of Spacewalk, including 2.6, vulnerable.<br>> <br>> Thoughts? I believe it's applicable, but I may be mistaken, please correct me <br>> if I'm wrong!!!<br>> <br>> If it is vulnerable, is there an alternative package that is known to work <br>> with Spacewalk? I am facing the very real possibility of being required to <br>> take my Spacewalk server offline today, a huge impact to my environment.<br>> <br>> Thanks!<br>> <br>> _______________________________________________<br>> Spacewalk-list mailing list<br>> Spacewalk-list@redhat.com<br>> https://www.redhat.com/mailman/listinfo/spacewalk-list<br><br>--<br>Oracle <http://www.oracle.com><br>Avi Miller | Product Management Director | +61 (3) 8616 3496<br>Oracle Linux and Virtualization<br>417 St Kilda Road, Melbourne, Victoria 3004 Australia<br><br><br>_______________________________________________<br>Spacewalk-list mailing list<br>Spacewalk-list@redhat.com<br>https://www.redhat.com/mailman/listinfo/spacewalk-list</body></html>