Apache Security Advisory
Apache Sling Security Bundle Updates Address Two Filter Bypasses
Apache Sling Security Bundle fixes RefererFilter and ContentDispositionFilter bypasses at different version floors. Choose a supported release containing both fixes and verify the active bundle; stopping at 1.3.2 leaves the later issue unresolved.
Apache Sling XSS 2.4.12 Addresses Five Sanitization and Resource Flaws
Apache Sling XSS 2.4.12 addresses sanitization bypasses and XML resource-limit flaws. Update the deployed XSS bundle itself and review exposed input paths; a Sling platform version alone does not establish remediation.
Apache Doris Updates Address Authentication Bypass and JDBC Code Execution
Apache Doris has separate metadata-authentication and privileged JDBC code-execution flaws. Restrict FE interfaces and driver-management permissions, then choose an upgrade covering both; the 4.0.8 metadata fix alone does not establish JDBC protection.
Apache BuildStream 2.8.1 Blocks Tar Extraction Escape
BuildStream's tar source plugin can follow malicious archive symlinks outside extraction paths when affected releases run on Python before 3.12. Update build runners with the 2.8.1 fix and verify their actual interpreter and source trust.
Apache MINA Corrects an Incomplete Deserialization Fix
MINA's announced deserialization fix missed the 2.0 and 2.1 maintenance branches. Verify the deployed artifact and use the corrected 2.0.31 or 2.1.15 release, reopening remediation records that relied on the earlier fix claim.
Apache Airflow 3.3.2 Fixes Authorization and Token Handling
Airflow fixes separate asset-event disclosure, cookie/bearer identity confusion and logout token-revocation failures. Match each issue's version and permissions, update the deployment, and validate event visibility and authentication behavior with authorized test accounts.
Apache Neethi 3.2.4 Addresses Five Policy Processing Flaws
Crafted policies can exhaust memory, multiply processing work or keep remote fetches open in Apache Neethi. Update the deployed dependency and validate parsing, normalization and reference handling with approved inputs, considering which policy sources the application trusts.
Apache MINA Releases Bound Zlib Decompression
Apache MINA's inbound CompressionFilter can allocate unbounded memory while expanding data. Upgrade the matching branch and configure a decompressed-size limit; validate ordinary traffic and limit handling outside production rather than treating a dependency update as sufficient.