~ / search / GHSA-v6w3-2prq-h95f

GHSA-v6w3-2prq-h95f

Improper Input Validation in Jakarta Expression Language

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-28170

Packages

EcosystemPackageAffectedFixed in
Maven com.sun.el:el-ri < 3.0.4 3.0.4
Maven org.glassfish:jakarta.el < 3.0.4 3.0.4
Maven org.glassfish:javax.el <= 3.0.1-b12 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if they were valid.

References

External links from the advisory. They lead to third-party sites.