Announcement

Collapse
No announcement yet.
X
  • Filter
  • Time
Clear All
new posts

    poi (CVE-2022-26336)

    Hi 
    Component
    Apache POI 3.17

    Component Path
    smartgwtpower-12.1p\lib/poi-3.17.jar

    CVE Number
    CVE-2022-26336

    Description
    A shortcoming in the HMEF package of poi-scratchpad (Apache POI) allows an attacker to cause an Out of Memory exception.
    This package is used to read TNEF files (Microsoft Outlook and Microsoft Exchange Server).
    If an application uses poi-scratchpad to parse TNEF files and the application allows untrusted users to supply them, then a carefully crafted file can cause an Out of Memory exception.
    This issue affects poi-scratchpad version 5.2.0 and prior versions. Users are recommended to upgrade to poi-scratchpad 5.2.1.
    https://nvd.nist.gov/vuln/detail/CVE-2022-26336

    All the links above point that vulnerability is present with smartclient v12.1p_2021-07-14.
    My query is, is this vulnerability resolved in any later version of smartclient? If yes, what exact version has addressed it? And correspondingly, which version of SmartGWT to use.

    Thanks in advance.

    #2
    Hi Isomorphic:
    Can you give me some advice?

    Comment


      #3
      We are not using this package, in fact the poi-3.17 jars we ship Smartclient with do not even include HMEF package. So, you are completely safe and not exposed to this vulnerability.

      Comment


        #4
        Thank you for your reply.
        I understanded is not vulnerability

        Comment

        Working...
        X