poi (CVE-2022-26336)

[kzkondoh]

Hi　
Component
Apache POI 3.17

Component Path
smartgwtpower-12.1p\lib/poi-3.17.jar

CVE Number
CVE-2022-26336

Description
A shortcoming in the HMEF package of poi-scratchpad (Apache POI) allows an attacker to cause an Out of Memory exception.
This package is used to read TNEF files (Microsoft Outlook and Microsoft Exchange Server).
If an application uses poi-scratchpad to parse TNEF files and the application allows untrusted users to supply them, then a carefully crafted file can cause an Out of Memory exception.
This issue affects poi-scratchpad version 5.2.0 and prior versions. Users are recommended to upgrade to poi-scratchpad 5.2.1.
https://nvd.nist.gov/vuln/detail/CVE-2022-26336

All the links above point that vulnerability is present with smartclient v12.1p_2021-07-14.
My query is, is this vulnerability resolved in any later version of smartclient? If yes, what exact version has addressed it? And correspondingly, which version of SmartGWT to use.

Thanks in advance.

[kzkondoh]

Hi Isomorphic:
Can you give me some advice?

[Isomorphic]

We are not using this package, in fact the poi-3.17 jars we ship Smartclient with do not even include HMEF package. So, you are completely safe and not exposed to this vulnerability.

[kzkondoh]

Thank you for your reply.
I understanded is not vulnerability