lukaszlenart commented on code in PR #323:
URL: https://github.com/apache/struts-site/pull/323#discussion_r3781909327
##########
source/index.html:
##########
@@ -50,13 +50,17 @@ <h2>End-of-Life Struts Versions</h2>
</div>
<div class="row">
<div class="column col-md-4">
- <h2>CVE-2025-68493: XXE vulnerability in XWork component</h2>
+ <h2>Security Bulletins S2-070 to S2-074</h2>
<p>
- Upgrade to at least Apache Struts 6.1.1 to mitigate the
vulnerability.
+ Upgrade to Apache Struts 7.3.0 or 6.11.0 to mitigate the
vulnerabilities.
</p>
<p>
- Read more in the <a href="announce-2026#a20260111">Announcement</a>
or in
- the Security Bulletin <a href="{{ site.wiki_url }}/S2-069">S2-069</a>
+ Read more in the <a
href="announce-2026#a20260814-s2070">Announcements</a> or in
+ the Security Bulletins <a href="{{ site.wiki_url
}}/S2-070">S2-070</a>,
+ <a href="{{ site.wiki_url }}/S2-071">S2-071</a>,
+ <a href="{{ site.wiki_url }}/S2-072">S2-072</a>,
+ <a href="{{ site.wiki_url }}/S2-073">S2-073</a> and
+ <a href="{{ site.wiki_url }}/S2-074">S2-074</a>
Review Comment:
Fixed in 297e887c5. The paragraph became a list, so each bulletin links to
its own announcement anchor and carries a short subject rather than five
identical "announcement" links:
- S2-070: shared parsing state in the JSON plugin
- S2-071: shared serialization state in the JSON plugin
- S2-072: unbounded read of a JSON request body
- S2-073: unbounded read of a Content Security Policy violation report
- S2-074: unbounded growth of localized-text caches
Verified against a local `jekyll build` that all five
`announce-2026#a20260814-s207x` hrefs match a generated `id` in
`announce-2026.html`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
