CVE-2021-28170 Fix expression delimiter escaping #160

TomasHofman · 2021-07-01T09:11:01Z

Co-authored-by: rmartinc [email protected]

Fixes #155

Co-authored-by: rmartinc [email protected]

pdudits

Thank you.

AppSecConcierge · 2021-07-07T15:52:06Z

Any ETA on when this fix will be released into a new version?

eskimopip · 2021-08-08T12:30:53Z

+1 for a merge and new version

dantran · 2021-08-14T00:53:40Z

Can we have this fix into 3.x? it is not possible for us to upgrade 4.x due to packaging changes

dantran · 2021-08-14T21:46:30Z

found a good replacement from jboss repo - https://repository.jboss.org/nexus/content/repositories/thirdparty-releases/org/glassfish/jakarta.el/

m0mus

LGTM

jbescos

LGTM

m0mus · 2021-08-16T10:19:46Z

There are missing copyright headers. I'll merge it and we'll add it later respecting the authorship.

mmkamburova · 2021-08-16T15:15:22Z

We need this fix as well in v3.x as it'll be impossible at the moment to upgrade to v4.x. Could you please let us know whether you're planning to port it in v3.x and provide an ETA if so?

Thanks,
Maria

Co-authored-by: rmartinc [email protected]

* CVE-2021-28170 Fix expression delimiter escaping (#160) Co-authored-by: rmartinc [email protected] * Fix copyrights (#164) Signed-off-by: Jorge Bescos Gascon <[email protected]> * javax adaptation Signed-off-by: Maxim Nesen <[email protected]> Co-authored-by: TomasHofman <[email protected]> Co-authored-by: jbescos <[email protected]>

deepmanit · 2021-08-18T05:29:35Z

is it merged in version 3.0.3 or we need to upgrade for 4.x. to fix the issue

joschi · 2021-08-18T06:01:28Z

@deepmanit The changes are in https://github.com/eclipse-ee4j/el-ri/releases/tag/3.0.4-impl but it hasn't been published to Maven Central yet.

Sachpat · 2021-09-21T07:33:26Z

@deepmanit The changes are in https://github.com/eclipse-ee4j/el-ri/releases/tag/3.0.4-impl but it hasn't been published to Maven Central yet.

@joschi any idea when will the 3.x be pushed to Maven central? It would be really helpful if we get it ASAP in Maven Central :)

fenneclabs · 2021-09-21T07:37:52Z

@deepmanit The changes are in https://github.com/eclipse-ee4j/el-ri/releases/tag/3.0.4-impl but it hasn't been published to Maven Central yet.

@joschi any idea when will the 3.x be pushed to Maven central? It would be really helpful if we get it ASAP in Maven Central :)

It's been there for a month now: https://search.maven.org/artifact/com.sun.el/el-ri/3.0.4/jar

Sachpat · 2021-09-21T08:15:29Z

@deepmanit The changes are in https://github.com/eclipse-ee4j/el-ri/releases/tag/3.0.4-impl but it hasn't been published to Maven Central yet.

@joschi any idea when will the 3.x be pushed to Maven central? It would be really helpful if we get it ASAP in Maven Central :)

It's been there for a month now: https://search.maven.org/artifact/com.sun.el/el-ri/3.0.4/jar

@fenneclabs but I don't see jakarta.el:jakarta.el-api:3.0.4 in maven central. Am I missing something here?

markt-asf · 2021-09-21T08:28:01Z

@fenneclabs but I don't see jakarta.el:jakarta.el-api:3.0.4 in maven central. Am I missing something here?

Yes. The API and the implementation are separate and are provided in separate JARs. This is a vulnerability in the Glassfish implementation of the EL API so the Glassfish implementation was updated. The EL API is unaffected.

@test

After `javax.el` v. 3.0.1-b*, the artifactId was changed to `jakarta.el`, cf. https://github.com/javaee/uel-ri: > This project is now part of the EE4J initiative. > This repository has been archived > as all activities are now happening in the corresponding Eclipse repository. `jakarta.el` v. <= 3.0.3 (and likewise previous versions of `javax.el`) suffer from https://nvd.nist.gov/vuln/detail/CVE-2021-28170. Its effect can be seen in the following unit tests (after jakartaee/expression-language#160): ``` @test public void testEscape01() { testEvaluation("$${1+1}", "$2"); testEvaluation("$\\${1+1}", "$${1+1}"); // is actually "$\2" with {javax,jakarta}.el < 3.0.4 } @test public void testEscape02() { testEvaluation("$#{1+1}", "$2"); testEvaluation("$\\#{1+1}", "$#{1+1}"); // is actually "$\2" with {javax,jakarta}.el < 3.0.4 } @test public void testEscape03() { testEvaluation("##{1+1}", "#2"); testEvaluation("#\\#{1+1}", "##{1+1}"); // is actually "#\2" with {javax,jakarta}.el < 3.0.4 } @test public void testEscape04() { testEvaluation("#${1+1}", "#2"); testEvaluation("#\\${1+1}", "#${1+1}"); // is actually "#\2" with {javax,jakarta}.el < 3.0.4 } void testEvaluation(String expression, String expectedValue) { javax.el.ELContext context = new javax.el.ELProcessor().getELManager().getELContext(); Object evaluatedExpression = javax.el.ELManager.getExpressionFactory() .createValueExpression(context, expression, String.class) .getValue(context); assertThat(evaluatedExpression).isEqualTo(expectedValue); } ``` Signed-off-by: Manfred Hanke <[email protected]>

@test

After `javax.el` v. 3.0.1-b*, the artifactId was changed to `jakarta.el`, cf. https://github.com/javaee/uel-ri: > This project is now part of the EE4J initiative. > This repository has been archived > as all activities are now happening in the corresponding Eclipse repository. `jakarta.el` v. <= 3.0.3 (and likewise previous versions of `javax.el`) suffer from https://nvd.nist.gov/vuln/detail/CVE-2021-28170. Its effect can be seen in the following unit tests (after jakartaee/expression-language#160): ``` @test public void testEscape01() { testEvaluation("$${1+1}", "$2"); testEvaluation("$\\${1+1}", "$${1+1}"); // is actually "$\2" with {javax,jakarta}.el < 3.0.4 } @test public void testEscape02() { testEvaluation("$#{1+1}", "$2"); testEvaluation("$\\#{1+1}", "$#{1+1}"); // is actually "$\2" with {javax,jakarta}.el < 3.0.4 } @test public void testEscape03() { testEvaluation("##{1+1}", "#2"); testEvaluation("#\\#{1+1}", "##{1+1}"); // is actually "#\2" with {javax,jakarta}.el < 3.0.4 } @test public void testEscape04() { testEvaluation("#${1+1}", "#2"); testEvaluation("#\\${1+1}", "#${1+1}"); // is actually "#\2" with {javax,jakarta}.el < 3.0.4 } void testEvaluation(String expression, String expectedValue) { javax.el.ELContext context = new javax.el.ELProcessor().getELManager().getELContext(); Object evaluatedExpression = javax.el.ELManager.getExpressionFactory() .createValueExpression(context, expression, String.class) .getValue(context); assertThat(evaluatedExpression).isEqualTo(expectedValue); } ``` Signed-off-by: Manfred Hanke <[email protected]>

@test

After `javax.el` v. 3.0.1-b*, the artifactId was changed to `jakarta.el`, cf. https://github.com/javaee/uel-ri: > This project is now part of the EE4J initiative. > This repository has been archived > as all activities are now happening in the corresponding Eclipse repository. `jakarta.el` v. <= 3.0.3 (and likewise previous versions of `javax.el`) suffer from https://nvd.nist.gov/vuln/detail/CVE-2021-28170. Its effect can be seen in the following unit tests (after jakartaee/expression-language#160): ``` @test public void testEscape01() { testEvaluation("$${1+1}", "$2"); testEvaluation("$\\${1+1}", "$${1+1}"); // is actually "$\2" with {javax,jakarta}.el < 3.0.4 } @test public void testEscape02() { testEvaluation("$#{1+1}", "$2"); testEvaluation("$\\#{1+1}", "$#{1+1}"); // is actually "$\2" with {javax,jakarta}.el < 3.0.4 } @test public void testEscape03() { testEvaluation("##{1+1}", "#2"); testEvaluation("#\\#{1+1}", "##{1+1}"); // is actually "#\2" with {javax,jakarta}.el < 3.0.4 } @test public void testEscape04() { testEvaluation("#${1+1}", "#2"); testEvaluation("#\\${1+1}", "#${1+1}"); // is actually "#\2" with {javax,jakarta}.el < 3.0.4 } void testEvaluation(String expression, String expectedValue) { javax.el.ELContext context = new javax.el.ELProcessor().getELManager().getELContext(); Object evaluatedExpression = javax.el.ELManager.getExpressionFactory() .createValueExpression(context, expression, String.class) .getValue(context); assertThat(evaluatedExpression).isEqualTo(expectedValue); } ``` Signed-off-by: Manfred Hanke <[email protected]>

@test

After `javax.el` v. 3.0.1-b*, the artifactId was changed to `jakarta.el`, cf. https://github.com/javaee/uel-ri: > This project is now part of the EE4J initiative. > This repository has been archived > as all activities are now happening in the corresponding Eclipse repository. `jakarta.el` v. <= 3.0.3 (and likewise previous versions of `javax.el`) suffer from https://nvd.nist.gov/vuln/detail/CVE-2021-28170. Its effect can be seen in the following unit tests (after jakartaee/expression-language#160): ``` @test public void testEscape01() { testEvaluation("$${1+1}", "$2"); testEvaluation("$\\${1+1}", "$${1+1}"); // is actually "$\2" with {javax,jakarta}.el < 3.0.4 } @test public void testEscape02() { testEvaluation("$#{1+1}", "$2"); testEvaluation("$\\#{1+1}", "$#{1+1}"); // is actually "$\2" with {javax,jakarta}.el < 3.0.4 } @test public void testEscape03() { testEvaluation("##{1+1}", "#2"); testEvaluation("#\\#{1+1}", "##{1+1}"); // is actually "#\2" with {javax,jakarta}.el < 3.0.4 } @test public void testEscape04() { testEvaluation("#${1+1}", "#2"); testEvaluation("#\\${1+1}", "#${1+1}"); // is actually "#\2" with {javax,jakarta}.el < 3.0.4 } void testEvaluation(String expression, String expectedValue) { javax.el.ELContext context = new javax.el.ELProcessor().getELManager().getELContext(); Object evaluatedExpression = javax.el.ELManager.getExpressionFactory() .createValueExpression(context, expression, String.class) .getValue(context); assertThat(evaluatedExpression).isEqualTo(expectedValue); } ``` Signed-off-by: Manfred Hanke <[email protected]>

@test

After `javax.el` v. 3.0.1-b*, the artifactId was changed to `jakarta.el`, cf. https://github.com/javaee/uel-ri: > This project is now part of the EE4J initiative. > This repository has been archived > as all activities are now happening in the corresponding Eclipse repository. `jakarta.el` v. <= 3.0.3 (and likewise previous versions of `javax.el`) suffer from https://nvd.nist.gov/vuln/detail/CVE-2021-28170. Its effect can be seen in the following unit tests (after jakartaee/expression-language#160): ``` @test public void testEscape01() { testEvaluation("$${1+1}", "$2"); testEvaluation("$\\${1+1}", "$${1+1}"); // is actually "$\2" with {javax,jakarta}.el < 3.0.4 } @test public void testEscape02() { testEvaluation("$#{1+1}", "$2"); testEvaluation("$\\#{1+1}", "$#{1+1}"); // is actually "$\2" with {javax,jakarta}.el < 3.0.4 } @test public void testEscape03() { testEvaluation("##{1+1}", "#2"); testEvaluation("#\\#{1+1}", "##{1+1}"); // is actually "#\2" with {javax,jakarta}.el < 3.0.4 } @test public void testEscape04() { testEvaluation("#${1+1}", "#2"); testEvaluation("#\\${1+1}", "#${1+1}"); // is actually "#\2" with {javax,jakarta}.el < 3.0.4 } void testEvaluation(String expression, String expectedValue) { javax.el.ELContext context = new javax.el.ELProcessor().getELManager().getELContext(); Object evaluatedExpression = javax.el.ELManager.getExpressionFactory() .createValueExpression(context, expression, String.class) .getValue(context); assertThat(evaluatedExpression).isEqualTo(expectedValue); } ``` Signed-off-by: Manfred Hanke <[email protected]>

@test

After `javax.el` v. 3.0.1-b*, the artifactId was changed to `jakarta.el`, cf. https://github.com/javaee/uel-ri: > This project is now part of the EE4J initiative. > This repository has been archived > as all activities are now happening in the corresponding Eclipse repository. `jakarta.el` v. <= 3.0.3 (and likewise previous versions of `javax.el`) suffer from https://nvd.nist.gov/vuln/detail/CVE-2021-28170. Its effect can be seen in the following unit tests (after jakartaee/expression-language#160): ``` @test public void testEscape01() { testEvaluation("$${1+1}", "$2"); testEvaluation("$\\${1+1}", "$${1+1}"); // is actually "$\2" with {javax,jakarta}.el < 3.0.4 } @test public void testEscape02() { testEvaluation("$#{1+1}", "$2"); testEvaluation("$\\#{1+1}", "$#{1+1}"); // is actually "$\2" with {javax,jakarta}.el < 3.0.4 } @test public void testEscape03() { testEvaluation("##{1+1}", "#2"); testEvaluation("#\\#{1+1}", "##{1+1}"); // is actually "#\2" with {javax,jakarta}.el < 3.0.4 } @test public void testEscape04() { testEvaluation("#${1+1}", "#2"); testEvaluation("#\\${1+1}", "#${1+1}"); // is actually "#\2" with {javax,jakarta}.el < 3.0.4 } void testEvaluation(String expression, String expectedValue) { javax.el.ELContext context = new javax.el.ELProcessor().getELManager().getELContext(); Object evaluatedExpression = javax.el.ELManager.getExpressionFactory() .createValueExpression(context, expression, String.class) .getValue(context); assertThat(evaluatedExpression).isEqualTo(expectedValue); } ``` Signed-off-by: Manfred Hanke <[email protected]>

@test

After `javax.el` v. 3.0.1-b*, the artifactId was changed to `jakarta.el`, cf. https://github.com/javaee/uel-ri: > This project is now part of the EE4J initiative. > This repository has been archived > as all activities are now happening in the corresponding Eclipse repository. `jakarta.el` v. <= 3.0.3 (and likewise previous versions of `javax.el`) suffer from https://nvd.nist.gov/vuln/detail/CVE-2021-28170. Its effect can be seen in the following unit tests (after jakartaee/expression-language#160): ``` @test public void testEscape01() { testEvaluation("$${1+1}", "$2"); testEvaluation("$\\${1+1}", "$${1+1}"); // is actually "$\2" with {javax,jakarta}.el < 3.0.4 } @test public void testEscape02() { testEvaluation("$#{1+1}", "$2"); testEvaluation("$\\#{1+1}", "$#{1+1}"); // is actually "$\2" with {javax,jakarta}.el < 3.0.4 } @test public void testEscape03() { testEvaluation("##{1+1}", "#2"); testEvaluation("#\\#{1+1}", "##{1+1}"); // is actually "#\2" with {javax,jakarta}.el < 3.0.4 } @test public void testEscape04() { testEvaluation("#${1+1}", "#2"); testEvaluation("#\\${1+1}", "#${1+1}"); // is actually "#\2" with {javax,jakarta}.el < 3.0.4 } void testEvaluation(String expression, String expectedValue) { javax.el.ELContext context = new javax.el.ELProcessor().getELManager().getELContext(); Object evaluatedExpression = javax.el.ELManager.getExpressionFactory() .createValueExpression(context, expression, String.class) .getValue(context); assertThat(evaluatedExpression).isEqualTo(expectedValue); } ``` Signed-off-by: Manfred Hanke <[email protected]>

CVE-2021-28170 Fix expression delimiter escaping

b6a3943

Co-authored-by: rmartinc [email protected]

This was referenced Jul 1, 2021

GHSL-2020-021 - Bypass input sanitization of EL expressions #155

Closed

ELParserTokenManager enables invalid EL expressions to be evaluate jbossas/el-ri#2

Merged

pdudits mentioned this pull request Jul 2, 2021

FISH-1421: CVE-2021-28170 port from upstream payara/patched-src-el-ri#4

Merged

pdudits approved these changes Jul 2, 2021

View reviewed changes

m0mus approved these changes Aug 16, 2021

View reviewed changes

jbescos approved these changes Aug 16, 2021

View reviewed changes

m0mus merged commit fe0c60b into jakartaee:master Aug 16, 2021

jbescos mentioned this pull request Aug 16, 2021

Fix copyrights #164

Merged

el-bot pushed a commit that referenced this pull request Aug 17, 2021

CVE-2021-28170 Fix expression delimiter escaping (#160)

de73c2b

Co-authored-by: rmartinc [email protected]

senivam pushed a commit to senivam/el-ri that referenced this pull request Aug 17, 2021

CVE-2021-28170 Fix expression delimiter escaping (jakartaee#160)

5f65b99

Co-authored-by: rmartinc [email protected]

strehle mentioned this pull request Aug 21, 2021

Eclipse Jakarta Expression Language library needs version bump cloudfoundry/uaa#1653

Closed

nicoloboschi mentioned this pull request Jan 25, 2022

[security] pulsar-io-kafka: upgrade jakarta.el to 3.0.4 to get rid of CVE-2021-28170 apache/pulsar#13943

Merged

1 task

YevhenBondarenko mentioned this pull request Mar 17, 2022

[3.4][improvements] update versions thingsboard/thingsboard#6278

Closed

echristeson mentioned this pull request May 24, 2022

Input Validation Vulnerability in Dependency jmrozanec/cron-utils#517

Closed

dondonz mentioned this pull request Sep 26, 2022

Update jakarta.el to include patch for CVE-2021-28170 graphql-java/graphql-java-extended-validation#78

Merged

AASMACMX mentioned this pull request Feb 26, 2023

CVE-2021-28170 @ Maven-org.glassfish:jakarta.el-3.0.3 CxDemoInABoxRepos/Java-Webgoat#255

Open

poorbarcode mentioned this pull request Mar 9, 2023

[fix][sec] Upgrade dependency-check-maven and remove javax.el apache/pulsar#19764

Merged

4 tasks

AASMACMX mentioned this pull request Apr 26, 2023

CVE-2021-28170 @ Maven-org.glassfish:jakarta.el-3.0.3 CxDemoInABoxRepos/Java-Webgoat#507

Open

AASMACMX mentioned this pull request Jul 10, 2023

CVE-2021-28170 @ Maven-org.glassfish:jakarta.el-3.0.3 CxDemoInABoxRepos/Java-Webgoat#823

Open

This was referenced Jul 22, 2024

[Urgent][Security Bugs]LPD-31880 patch com.sun.el.javax.el to fix CVE-2021-28170 liferay-core-infra/liferay-portal#7279

Closed

[Urgent][Security Bugs]LPD-31880 patch com.sun.el.javax.el to fix CVE-2021-28170 liferay-core-infra/liferay-portal#7283

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

CVE-2021-28170 Fix expression delimiter escaping #160

CVE-2021-28170 Fix expression delimiter escaping #160

TomasHofman commented Jul 1, 2021

pdudits left a comment

AppSecConcierge commented Jul 7, 2021

eskimopip commented Aug 8, 2021

dantran commented Aug 14, 2021

dantran commented Aug 14, 2021

m0mus left a comment

jbescos left a comment

m0mus commented Aug 16, 2021

mmkamburova commented Aug 16, 2021

deepmanit commented Aug 18, 2021

joschi commented Aug 18, 2021 •

edited

Loading

Sachpat commented Sep 21, 2021 •

edited

Loading

fenneclabs commented Sep 21, 2021

Sachpat commented Sep 21, 2021 •

edited

Loading

markt-asf commented Sep 21, 2021

CVE-2021-28170 Fix expression delimiter escaping #160

CVE-2021-28170 Fix expression delimiter escaping #160

Conversation

TomasHofman commented Jul 1, 2021

pdudits left a comment

Choose a reason for hiding this comment

AppSecConcierge commented Jul 7, 2021

eskimopip commented Aug 8, 2021

dantran commented Aug 14, 2021

dantran commented Aug 14, 2021

m0mus left a comment

Choose a reason for hiding this comment

jbescos left a comment

Choose a reason for hiding this comment

m0mus commented Aug 16, 2021

mmkamburova commented Aug 16, 2021

deepmanit commented Aug 18, 2021

joschi commented Aug 18, 2021 • edited Loading

Sachpat commented Sep 21, 2021 • edited Loading

fenneclabs commented Sep 21, 2021

Sachpat commented Sep 21, 2021 • edited Loading

markt-asf commented Sep 21, 2021

joschi commented Aug 18, 2021 •

edited

Loading

Sachpat commented Sep 21, 2021 •

edited

Loading

Sachpat commented Sep 21, 2021 •

edited

Loading