Skip to content

Commit

Permalink
Upgrade jsch from 0.1.52 to 0.1.55 to fix CVE-2016-5725
Browse files Browse the repository at this point in the history
Upgrading the jsch library from version 0.1.52 to 0.1.55 addresses
CVE-2016-5725, which is a directory traversal vulnerability in
JCraft JSch before version 0.1.54. This vulnerability allowed remote
SFTP servers to write to arbitrary files on Windows when using
ChannelSftp.OVERWRITE mode, via a ..\ (dot dot backslash) in a
recursive GET command.
  • Loading branch information
godaridillibabu authored and godaridillibabu committed Dec 11, 2024
1 parent 2a7cfc4 commit 176a562
Show file tree
Hide file tree
Showing 3 changed files with 31 additions and 2 deletions.
29 changes: 29 additions & 0 deletions .github/workflows/gradle.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
name: Java CI with Gradle

on:
push:
branches: [ "master" ]
pull_request:
branches: [ "master" ]

jobs:
build:
runs-on: ubuntu-latest
strategy:
fail-fast: true
matrix:
java-version:
- 8
steps:
- uses: actions/checkout@v4
with:
show-progress: false
fetch-depth: 0
- name: Set up JDK
uses: actions/setup-java@v4
with:
java-version: ${{ matrix.java-version }}
distribution: 'temurin'
cache: gradle
- name: Gradle Build
run: ./gradlew build
2 changes: 1 addition & 1 deletion build.gradle
Original file line number Diff line number Diff line change
Expand Up @@ -49,7 +49,7 @@ ext.versions = [
presto : '0.181',
reflections : '0.9.9',
bytebuddy : '0.7-rc2',
jsch : '0.1.52',
jsch : '0.1.55',
mina_sshd : '0.14.0',
freemarker : '2.3.22',
objenesis : '1.4',
Expand Down
2 changes: 1 addition & 1 deletion gradle.properties.example
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
#skipSigning=false
skipSigning=false
#signing.keyId=KEYID
#signing.password=KEY_PASSWORD
#signing.secretKeyRingFile=KEY_PATH
Expand Down

0 comments on commit 176a562

Please sign in to comment.