Details
-
Task
-
Status: Closed
-
Should
-
Resolution: Fixed
-
Platform 2.5.0
-
None
-
None
Description
There is a vulnerability reported on struts-core-1.3.8.jar. And this is coming as part of the org.apache.velocity.velocitytools dependency.
Steps followed to mitigate the vulnerability:
- Manually removed the struts-core-1.3.8.jar from the openmrs env.
- Restarted the openmrs service.
Application started working fine without any issues, and we tested the basic flows. Everything looks fine.
Raised talk thread for the same.
https://talk.openmrs.org/t/struts-core-1-3-8-security-vulnerability-in-openmrs-core/36523
PR link to exclude the struts-core.1.3.8.jar from the pom.xml
https://github.com/openmrs/openmrs-core/pull/4083