[las_users] LAS struts security issue - need to upgrade to struts 2.5.25

To: "roland.schweitzer@xxxxxxxx" <roland.schweitzer@xxxxxxxx>

Subject: [las_users] LAS struts security issue - need to upgrade to struts 2.5.25

From: Bryan Littlefield <bryan.littlefield@xxxxxxxxxx>

Date: Mon, 26 Oct 2020 23:09:20 +0000

Accept-language: en-US

Arc-authentication-results: i=5; mx.google.com; dkim=pass header.i=@ssaihq.onmicrosoft.com header.s=selector1-ssaihq-onmicrosoft-com header.b=nUdl+Hxb; arc=pass (i=3 dkim=pass dkdomain=ssaihq.onmicrosoft.com); spf=fail (google.com: domain of bryan.littlefield@xxxxxxxxxx does not designate 209.85.160.199 as permitted sender) smtp.mailfrom=bryan.littlefield@xxxxxxxxxx

Arc-authentication-results: i=4; mx.google.com; dkim=pass header.i=@ssaihq.onmicrosoft.com header.s=selector1-ssaihq-onmicrosoft-com header.b=nUdl+Hxb; arc=pass (i=3 dkim=pass dkdomain=ssaihq.onmicrosoft.com); spf=fail (google.com: domain of bryan.littlefield@xxxxxxxxxx does not designate 209.85.160.199 as permitted sender) smtp.mailfrom=bryan.littlefield@xxxxxxxxxx

Arc-authentication-results: i=3; mx.google.com; dkim=pass header.i=@ssaihq.onmicrosoft.com header.s=selector1-ssaihq-onmicrosoft-com header.b=nUdl+Hxb; arc=pass (i=2 spf=pass spfdomain=ssaihq.com dkim=pass dkdomain=ssaihq.onmicrosoft.com); spf=fail (google.com: domain of bryan.littlefield@xxxxxxxxxx does not designate 65.153.203.170 as permitted sender) smtp.mailfrom=bryan.littlefield@xxxxxxxxxx

Arc-authentication-results: i=2; mx.google.com; dkim=pass header.i=@ssaihq.onmicrosoft.com header.s=selector1-ssaihq-onmicrosoft-com header.b=nUdl+Hxb; arc=pass (i=1 spf=pass spfdomain=ssaihq.com dkim=pass dkdomain=ssaihq.com dmarc=pass fromdomain=ssaihq.com); spf=pass (google.com: domain of bryan.littlefield@xxxxxxxxxx designates 2a01:111:f400:7eae::707 as permitted sender) smtp.mailfrom=bryan.littlefield@xxxxxxxxxx

Arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=ssaihq.com; dmarc=pass action=none header.from=ssaihq.com; dkim=pass header.d=ssaihq.com; arc=none

Arc-message-signature: i=5; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-archive:list-help:list-post:list-id:mailing-list:precedence :message-id:mime-version:content-language:accept-language:date :thread-index:thread-topic:subject:cc:to:from:sender:dkim-signature; bh=jYOC/W0QkdHp3Bk8fFvtkyrmWc94U9q38Z/R5h5OGZQ=; b=WEg08GMbRDRq3EGrDUPOIH7oWZv5g2HCq4YRmOVITuHvixcgzvDOf8lUSwyA8GkQ9h UStn8FlUW3tNfFXNjmlLX7MmKxOhxVLYjwLYOUD0fGxD1uOgwBhZF3pJPePBOwL6Xq6Q Gdh23CwpqLl1ZN9zkSdSabgwKLEDXUD1ou4oyjyxy8dBgN6gtq0rjYtyTRZx4KBiPblj PjzRnzIvp7y7sAMsZi8ZV5iAt5/zalfIsMHb5pmlPupDu0q/GbneXXUexUicmVLqp2jN ROdGQr192tIeVekicmBa7gj5qMZUK5Q3ymVVo0OVATRvtQ1eU4s1gNrtNtyWdpWuev/I y5Hw==

Arc-message-signature: i=4; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=message-id:mime-version:content-language:accept-language:date :thread-index:thread-topic:subject:cc:to:from:dkim-signature; bh=jYOC/W0QkdHp3Bk8fFvtkyrmWc94U9q38Z/R5h5OGZQ=; b=grPqcppMb0GV/IA5yY2BNfq9B9EGhN075Lu52wcLx7fR65zr3ZZAuIQUfTHH3kkfUX kM3ZzT8hV2x4ZNbKTFGuTMWiRIFj54lgmnk6eGZ1scnKlF9c3qXi5NRokg1YIpTAGZKe aNMjaNQ1NXv6vU5c8shX/A3gHq8D5FVYGNMDkNNOQ/QTK3w+RRxx71GZ1rEuTMjjntpV au/3ExRq7yB6UdeHz9S4elVDsnYHMFqu/z9zHxuqr42DIoBJH1UyyHoAqOb2M6MeBIRf 4VPWJXG9buegYjm/U2xLX+kZlzmwQ7bMSV5YDbB6yhJ5Ds/lz6TOqIZmqlatyx0KZWJL Kdlg==

Arc-message-signature: i=3; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=mime-version:content-language:accept-language:message-id:date :thread-index:thread-topic:subject:cc:to:from:dkim-signature; bh=jYOC/W0QkdHp3Bk8fFvtkyrmWc94U9q38Z/R5h5OGZQ=; b=vYTCT2sAW7HlNFYSiiGlrnHFDN7cb0112S/9jdKfX2W0Hx4Yv5Bh53iW2Y2T4p7mNf GMWU5rbUuNg3KeT2ybgrgChn85nAeflYIPtrZX6+8xm4M/Xb80W2cWWR8phUQbdq/U87 oqCCHGwPhUXm6EeAPb0Fuzfs5yAAfTTNLZrsdf+0veFBRBAcBjg1UQ52069LHDDE+nNr bqgXV0DZ1/YsamdxW05Aaa9DsebF+YzAAb+njN/31aRJQeW7WFUSKkwx2B/r+ye3Vr04 +RfjYyjFB9NuU8LnC2qyEuVOjeTAruhBx7QsnFoOkKTkCa5/EQb7tjXnlYexocV/7lHm d90g==

Arc-message-signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=mime-version:content-language:accept-language:message-id:date :thread-index:thread-topic:subject:cc:to:from:dkim-signature; bh=jYOC/W0QkdHp3Bk8fFvtkyrmWc94U9q38Z/R5h5OGZQ=; b=StTMRM3KQXE3I/KbV7jutBNA3mzhwVAXE84CqVAsc1NtOBJRdidtyo+YzZtBOTyABw +OySjUlsap7SYbZ4/9jIfb7YYqW1b2I8H7ANXyudfI3OaOUaR4IIZblIcp+ilSibUITC hQY5Lwww40JlaU8NMwLVHS5snUtY3ASxvZ1HNGBkLXIWV7ahoEhmsTqE7ZmtkLQBtomo A/C9kEB82XQSqRDkZjm30ZD1Wg7LsCKiCz3sXt3ANZFPgPkEiAOITzusfDRrlqb21oti iis9XrsQnXksACUkCE/UzNGNata6SHhgMXFUJ48aubDC2UMap61Uw/LYNUi2xxGf1XGP O7Lg==

Arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=jYOC/W0QkdHp3Bk8fFvtkyrmWc94U9q38Z/R5h5OGZQ=; b=cWoTmDk00NEe6mddNvp0YTFTKBtTzMyr7NSRXXjrnoj49S6QZnoL4DCk/upYO3TrGGvzxWKb5L5CKe9ejPKRAgh6flbBkMjd9nGph/nRpeu1amnHlmf0meQUU7oFp1qQ8/+ix7gaWM6/G9DCgyGop+FoN63Yh+t65TL1hYicQ95Xsiszj/dx3I2kUrWkzZjIEf7OVwEEPnLEk0PlkcGIME2VDRneEzXA2hcUeRknkcofVNe3AdUSg84VNVaqes5jHrBn1+XkHI4CBZdSkVE1JfhDCJ9qds9BKTJSegO3JSUr295UpBHGvoEYOIi2xVrrPfsc8zfT0VF1C2WSnHBO2w==

Arc-seal: i=5; a=rsa-sha256; t=1603753767; cv=pass; d=google.com; s=arc-20160816; b=iLP5mJVhTmkVEnAmNusjczFv4gpgdzoIZMWjq0s9Wiu5+jqvsptuV87MSymIBtuWZb 7lAlBuS4LkKg/uEM6Jvje1UQ2B69p2JxtJxZib20i0VCC6iJMbxCW8MPJbIObnAHkwN/ sqnH6jFCYNNpuR6AWdmPvIC3Gjj0rKRgV/uW8XtGwlXlbozX0WrCzxvEUW0cPFQyfv4y SkBTbLiXDoYRQ4eoEWqzvyGTg1JUcHVvwOM/lNAwQi8WfIHHGwYzg8g5iO2M4VQd0Szx KM4vYNO5rkAuiWGX2nSce9jiEqGri0WLVxwMV5ryVWWULJ2jUyBCi2/sZpnB5Rc+eSwP A6eg==

Arc-seal: i=4; a=rsa-sha256; t=1603753766; cv=pass; d=google.com; s=arc-20160816; b=QEL8sdXoqjtvN80LTav8AKajn5rHt1Gw2BL0d93pYpd3pOZUW7KGud0XY/jVyQ19t/ fG2Md1XOHWqju993qKNxKpfZOclQFsfApHgaep+e53xKHh4BTk9Shww+NX6CFKacaSb0 NtWknKv/QK3F7ly7Yl1Ll5x5uT5LoFYvxA7Z4Z75aluNUzH0oBnpPDvtyLjEFUmeswsi El2SmrITO/i3PrGLuV0zwWJ/lUJ8IopjjTfGBtOabnHxpaKEyWq56+U7iblF4YBqmDFa OIzx8NJZduRspmFhbGqfpYkZamD05XGD6IJrEAeG4zNs2ZBZ4qBhP7+yt5QLz/09f4d+ DDPQ==

Arc-seal: i=3; a=rsa-sha256; t=1603753763; cv=pass; d=google.com; s=arc-20160816; b=PxcWxsbE2uuhJXnkh0myugxJAbt69ctrFo/SztM/uavwVT3rgTbs4KIBCVjGhyojS8 YgRlDNa9LtfsKSyeZtBko/WXOykUSTFhKMWuhM0B3+DQrLQFgvM/2uyUAhQERIJe2+4L 8mPYmbL7IjtfyLQgUX2yRym4RiFAF1Paxntf97dsuZ8lqtXxC1ATghWT08iJncaBTQkg 8YTXpjrLkzfMexepA3tlXPn56x1VOrupmk7l0Z0dHZo0cBODeBTkrxusAa/zBDsH3/CY S4qvC1K0sq8rugOGlgA+dY4H2XtoDMDz3qEuJ3JRT4a0hMTvrcoo/5ECccKjuawS+Tva oBkg==

Arc-seal: i=2; a=rsa-sha256; t=1603753761; cv=pass; d=google.com; s=arc-20160816; b=V1Qu0liizwH6TzXU8iL6dO0Yx2djaEQsPR8rX8vFDuplcpYRVWGPyp6kXM8zK2CmSC hsJLsff/qvQqV7vJL6ugKWD8A6KP8lplgiFDiEiJtekrol05yYWNwiygL6fZ80zmqBe1 VvmPHlgt2p+VCs8HLVFqI/CB3/SRT4IU1jsFBLMcNV6Gdxbnb5+SSLRAFY82EYqoaTpn H+1/ZOenJpdpNlK/jMMywpSJS9icb7f18zk66R9cvzYmPmDHh8hvkkBdJXgjGjTw2CRq ei/++aFSg/Sqpe4ayRqrHvncnVN8rkXUyXoHZkJpZBCME+zpfDc+2fqkPCg3lTM/dE/a PAPw==

Arc-seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=DvD7/TR7GNF6YnwIONwqEsQG1i05h2SXSaQpYcwJZdrFIy0cWTP2xiIwMVlcYPvPxQ+P+cjtGmbu1s5yDSLU0uyfXAAtgXp4tNuf9f9IB9AEJJKTpyYJ7EcT10XLhL498FvY9jNZHOJLCU10zYAg6UIoWg6CIGwp8DCHZyQf9f1zZJImnLcEK62M7JRsfqyJeM/DAdhamj/F7xnADezmQi40Z0Ngi3Qsxwy93Wido8kN+YguOa/wURrNtGozq9Tk6AMWGdPc8AEvPbRwRsMXPjFR5jYASrq6bvazP0832WZxIsWR7EnOwJW/iWer8UERiqeENe9f79sZcUwS6C0dvA==

Cc: "las_users@xxxxxxxx" <las_users@xxxxxxxx>

Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=noaa.gov; s=google; h=sender:from:to:cc:subject:thread-topic:thread-index:date :accept-language:content-language:mime-version:message-id :x-original-sender:x-original-authentication-results:precedence :mailing-list:list-id:list-post:list-help:list-archive; bh=jYOC/W0QkdHp3Bk8fFvtkyrmWc94U9q38Z/R5h5OGZQ=; b=hQ8ROaA5vwMGxY1BfKA5l/V1O+edbQY754SefhkgCtUmEpP5nW1CdB26BXtXVGd2Ez LHCzpx7LNuNuiRR/RIjzsO40axGQstbBUmrhSDfgSPDHZ2LulV6rAzFPmNSuFO76coFE P8BzVu87HORMh1gtXrX+IYCZpwJKxRaXac6sbKHub1At8jmzE6NQMjvYn2XM0i5G9DTe lo+Ii7xdH5gr7yNmPPo45pjzu/lhtyD3DV8/VuwzfcU0ychJB212PGD3FXcHsDMBO9hf 3jmLtzVeh20c6Did6p0f0iHUIBdff5WR08Snv5eyUggTAkBa3ppNtGKFWRFP+L7U4CX8 77Lg==

List-archive: <https://groups.google.com/a/noaa.gov/group/las_users/>

List-help: <https://support.google.com/a/noaa.gov/bin/topic.py?topic=25838>, <mailto:las_users+help@noaa.gov>

List-id: <las_users.noaa.gov>

List-post: <https://groups.google.com/a/noaa.gov/group/las_users/post>, <mailto:las_users@noaa.gov>

Mailing-list: list las_users@xxxxxxxx; contact las_users+owners@xxxxxxxx

Sender: owner-las_users@xxxxxxxx

Thread-index: Adar7N+RSbpR8WGzSbuU7Crgernnog==

Thread-topic: LAS struts security issue - need to upgrade to struts 2.5.25

HI Roland,

NASA opened a security ticket on our LAS with regards to Struts, we have structs 2.5.17 but need to upgrade to struts 2.5.25.

How do we upgrade structs, can we replace the JAR with the update one? Or do we have rebuild with ant (info below from github) ?

We have some custom content in webapps that would get wiped out by a “ant clean/deploy” operation, so we hesitate to rebuild.