Fw: [OSGeo-Discuss] GeoServer OGC Filter SQL Injection Vulnerabilities (CVE-2023-25158)

[신상희(Sanghee Shin)]

안녕하세요?

최근 GeoTools와 GeoServer에서 SQL Injection 계열의 보안 취약점이 발견되었습니다. 이에 어떻게 대응하고 패치해야 하는지 GeoServer 개발자 커뮤니티에서 기술문서를 내놨습니다. 참고하시기 바랍니다.

감사합니다. 

신상희
---
Shin, Sanghee
Gaia3D, Inc. - The GeoSpatial Company
www.gaia3d.com

------ Forwarded Message ------

From "Jody Garnett via Discuss" <dis...@lists.osgeo.org>

To "OSGeo Discussions" <dis...@lists.osgeo.org>

Date 2023-02-22 오전 6:19:54

Subject [OSGeo-Discuss] GeoServer OGC Filter SQL Injection Vulnerabilities (CVE-2023-25158)

The GeoServer team has released a statement: OGC Filter Injection Vulnerability Statement

A vulnerability has been located in the GeoTools Library that allows SQL Injection using OGC Filter and Function expressions.

• CVE-2023-25157 OGC Filter SQL Injection Vulnerabilities (GeoServer)
• CVE-2023-25158 OGC Filter SQL Injection Vulnerabilities (GeoTools)

Patched releases:

• GeoServer 2.22.2 stable release
• GeoServer 2.21.4 maintenance
• GeoServer 2.20.7
• GeoServer 2.19.7
• GeoServer 2.18.7

--

GeoServer Project Steering Committee