Apache Commons Text CVE-2022-42889

Autopsy Development
1

Hello all,
our EDR reports this vulnerability in the following 3 files:

  • c:\program files\autopsy-4.20.0\autopsy\solr\server\solr-webapp\webapp\web-inf\lib\commons-text-1.6.jar
  • c:\program files\autopsy-4.20.0\autopsy\solr\solr\lib\commons-text-1.6.jar
  • c:\program files\autopsy-4.20.0\autopsy\modules\ext\commons-text-1.9.jar

Since it’s marked a critical CVE I’m curious if I could simply replace those with a newer version, 1.10.0 is available from Apache Commons or we have to wait for a new Autopsy release to address those.

Thank you in advance!

2

I would not replace the libraries as they have not been tested with Autopsy and there could be issues with them. I will put this on the list of things that need to be looked at for a future release of Autopsy.

1 Like
3

I’ve just upgraded to 4.22.0 and it still seems to have the vulnerable commons-text-1.6.jar

4

The commons-text-1.6.jar file is associated with Solr. According to Solr security news Solr™ Security News - Apache Solr, the CVE-2022-42869 is not affected.

image
image1220×132 24.6 KB

Solr will have to be upgraded to a new release in order for the commons-text.jar file to be upgraded to a higher version.