Orbeon 2016.3: YUI version 2.8.1 security Vulnerabilties

classic Classic list List threaded Threaded
2 messages Options
Reply | Threaded
Open this post in threaded view
|

Orbeon 2016.3: YUI version 2.8.1 security Vulnerabilties

Naveen
Hi
We recently upgraded Orbeon to 2016.3 version. Our security scan has
identified vulnerabilities with included YUI 2.8.1 version (details below).
My question is
1. Is there any version of Orbeon which has YUI version 2.9.1 or above? If
so we would like to upgrade Orbeon once again.
2. Is it appropriate to just replace YUI version 2.8.1 with 2.9.1 inside
orbeon-resources-public.jar?
--------------Details -----------------
The library YUI version 2.8.1 has known security issues.
For more information, visit those websites:
http://www.cvedetails.com/cve/CVE-2012-5883/
Affected versions
The vulnerability is affecting all versions prior 2.9.1 (between 2.8.0 and
2.9.1)

Thanks
Nav

--
Sent from: http://discuss.orbeon.com/

--
You received this message because you are subscribed to the Google Groups "Orbeon Forms" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [hidden email].
To post to this group, send email to [hidden email].
Reply | Threaded
Open this post in threaded view
|

Re: Orbeon 2016.3: YUI version 2.8.1 security Vulnerabilties

Alessandro  Vernet
Administrator
Hi Nav,

This has been taken care of since 2016.1: not only all YUI Flash files have
been removed (since we don't use them), but the JavaScript code that loads
those files in YUI has been removed as well. For reference, this was issue
2396 (see link below). Since you're on 2016.3, you're all good with this.

https://github.com/orbeon/orbeon-forms/issues/2396

Alex

-----
--
Follow Orbeon on Twitter: @orbeon
Follow me on Twitter: @avernet
--
Sent from: http://discuss.orbeon.com/

--
You received this message because you are subscribed to the Google Groups "Orbeon Forms" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [hidden email].
To post to this group, send email to [hidden email].
--
Follow Orbeon on Twitter: @orbeon
Follow me on Twitter: @avernet