A pair of security updates released by the Apache Software Foundation patch vulnerabilities in Apache Struts versions 2.5 to 2.5.14 that would let a remote attacker take control of a system, according to a US-CERT alert.
The Apache Security Bulletin S2-054 resolves a outdated JSON-lib library in the REST Plugin, which would let miscreants execute denial of service (DoS) attacks “using malicious request with specially crafted JSON payload.”
The organisation advised administrators to upgrade to Apache Struts 18.104.22.168 or use the Jackson handler rather than the default JSON-lib handler.
Apache Security Bulletin S2-055 patches a Jackson Deserialiser in the Jackson JSON library. Administrators should upgrade to Apache Struts 22.214.171.124 or manually upgrade Jackson dependencies in a project to versions that are not vulnerable.