Skip to content

Commit 32a8fac

Browse files
kwwallkwwall
committed
ESAPI 2.7.0.0 release notes.
1 parent 4457c85 commit 32a8fac

File tree

1 file changed

+194
-0
lines changed

1 file changed

+194
-0
lines changed

‎documentation/esapi4java-core-2.7.0.0-release-notes.txt

Lines changed: 194 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,194 @@
1+
Release notes for ESAPI 2.7.0.0
2+
Release date: 2025-06-27
3+
Project leaders:
4+
-Kevin W. Wall <kevin.w.wall@gmail.com>
5+
-Matt Seil <matt.seil@owasp.org>
6+
7+
Previous release: ESAPI 2.6.2.0, 2025-06-02
8+
9+
10+
Executive Summary: Important Things to Note for this Release
11+
------------------------------------------------------------
12+
This is a major patch release with the primary intent of addressing CVE-2025-5878. See https://nvd.nist.gov/vuln/detail/CVE-2025-5078 and especially Security Bulletin #13 (https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/ESAPI-security-bulletin13.pdf) for details. It also updates Apache Commons FileUploads to 1.6.0 to address CVE-2025-48976. That CVE likely does not affect the HTTP.getFileUloads interfaces (which is the only methods that use that library), but we have not had time to analyze it fully given the CVE cited against ESAPI. Apache Commons BeanUtils was also updated to 1.11.0 to address CVE-2025-48734 which potentially could anyone using ESAPI's AccessController and has placed their access control policy in a place where an attacker may be overwrite it. That is highly unlikely, but better safe than sorry.
13+
14+
This 2.7.0.0 release also has significant Javadoc clarifications. Security Bulletin #13 explains why.
15+
16+
If you fail to read Security Bulletin #13 and you are affected by CVE-2025-5878, your application using ESAPI 2.7.0.0 will not work, so it is VERY IMPORTANT that you read that.
17+
18+
Notes if you are NOT updating from the immediate previous release. release 2.6.2.0:
19+
* You need to read through the series of release notes FIRST, going in order.
20+
* For example, if you were updating from an older ESAPI release (say, 2.3.0.0), you should go back and FIRST read all the subsequent release notes in turn. For instance, if you are currently on release 2.3.0.0 and upgrading to (say) release 2.x.y.z, you should MINIMALLY read the sections "Changes Requiring Special Attention" in each of the subsequent release notes. So, going from release 2.3.0.0 to 2.x.y.z, you should in turn, read:
21+
22+
esapi4java-core-2.4.0.0-release-notes.txt
23+
esapi4java-core-2.5.0.0-release-notes.txt
24+
esapi4java-core-2.5.1.0-release-notes.txt
25+
esapi4java-core-2.5.2.0-release-notes.txt
26+
...etc., up through the current set of release notes...
27+
esapi4java-core-2.x.y.z-release-notes.txt
28+
29+
in that order. YOU HAVE BEEN WARNED!!! (These release notes are too large to put all this in a given document; very few read them thoroughly as it is.)
30+
31+
If your SCA tool is reporting any CVE from a direct or transitive dependency in ESAPI, before reporting it as an GitHub issue, please make sure that you review the vulnerability analysis written up in https://github.com/ESAPI/esapi-java-legacy/blob/develop/Vulnerability-Summary.md. Please email us or contact us in our GitHub Discussions page if you have questions about this. See also the SECURITY.md file to report any security issues with ESAPI.
32+
33+
You are encouraged to review the vulnerability analysis written up in https://github.com/ESAPI/esapi-java-legacy/blob/develop/Vulnerability-Summary.md and email us or contact us in our GitHub Discussions page if you have questions.
34+
35+
36+
=================================================================================================================
37+
38+
Basic ESAPI facts
39+
-----------------
40+
41+
ESAPI 2.6.2.0 release:
42+
207 Java source files
43+
4312 JUnit tests in 133 Java source files
44+
45+
ESAPI 2.7.0.0 release:
46+
208 Java source files
47+
4312 JUnit tests in 134 Java source files
48+
49+
1 GitHub Issues closed in this release, including those we've decided not to fix (marked 'wontfix' and 'falsepositive').
50+
(Reference: https://github.com/ESAPI/esapi-java-legacy/issues?q=is%3Aissue+state%3Aclosed+updated%3A%3E%3D2025-06-02)
51+
52+
Issue # GitHub Issue Title
53+
----------------------------------------------------------------------------------------------
54+
883 Update Apache Commons BeanUtils from 1.9.4 to 1.11.0 to address CVE-2025-48734
55+
56+
-----------------------------------------------------------------------------
57+
58+
Changes Requiring Special Attention
59+
60+
-----------------------------------------------------------------------------
61+
62+
IMPORTANT: Read Security Bulletin #13 (https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/ESAPI-security-bulletin13.pdf)
63+
64+
Important JDK Support Announcement
65+
* ESAPI 2.3.0.0 was the last Java release to support Java 7. ESAPI 2.4.0 requires using Java 8 or later. See the ESAPI 2.4.0.0 release notes (https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/esapi4java-core-2.4.0.0-release-notes.txt) for details as to the reason.
66+
- This means if your project requires Java 7, you must use ESAPI 2.3.0.0 or earlier.
67+
68+
Important ESAPI Logging Changes
69+
70+
* Since ESAPI 2.5.0.0, support for logging directly via Log4J 1 has been removed. (This was two years after it having first been deprecated.) Thus, you only choice of ESAPI logging are
71+
- java.util.logging (JUL), which as been the default since ESAPI 2.2.1.0.
72+
* Set ESAPI.Logger=org.owasp.esapi.logging.java.JavaLogFactory in your ESAPI.properties file.
73+
- SLF4J (which your choice of supported SLF4J logging implementation)
74+
* Set ESAPI.Logger=org.owasp.esapi.logging.slf4j.Slf4JLogFactory in your ESAPI.properties file.
75+
* Logger configuration notes - If you are migrating from prior to ESAPI 2.2.1.1, you will need to update your ESAPI.properties file as logging-related configuration as per the ESAPI 2.2.1.1 release notes, which may be found at:
76+
https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/esapi4java-core-2.2.1.1-release-notes.txt#L39-L78
77+
78+
If you use ESAPI 2.5.0.0 or later, you will get an ClassNotFoundException as the root cause if you still have your ESAPI.Logger property set to use Log4J because the org.owasp.esapi.logger.log4j.Log4JFactory class has been completely removed from the ESAPI jar. If you are dead set on continuing to use Log4J 1, you ought to be able to do so via SLF4J. The set up for Log4J 1 (which has not be tested), should be similar to configure ESAPI to use SLF4J with Log4J 2 as described here:
79+
https://github.com/ESAPI/esapi-java-legacy/wiki/Using-ESAPI-with-SLF4J#slf4j-using-log4j-2x
80+
81+
-----------------------------------------------------------------------------
82+
83+
Remaining Known Issues / Problems
84+
85+
-----------------------------------------------------------------------------
86+
None known, other than the remaining open issues on GitHub.
87+
88+
-----------------------------------------------------------------------------
89+
90+
Other changes in this release, some of which not tracked via GitHub issues
91+
92+
-----------------------------------------------------------------------------
93+
94+
* Changes since last release 2.6.2.0 and 2.7.0.0, i.e., changes between 2025-06-02 and 2025-06-27).
95+
96+
Note: I am no longer going to provide the 'Developer Activity Report' that I used to this manually create in tabular form. This is in part because I use to use 'mvn site' to assist with its creation, but neither the 'Developer Activity' nor 'File Activity' sections of the 'mvn site' output is currently working.
97+
98+
That said, I don't care as this was always a major PITA and I think it had dubious value to start with.
99+
100+
Therefore, I am replacing it to a stock GitHub tag comparison of the current and previous release, which I can automate.
101+
102+
Please see,
103+
104+
https://github.com/ESAPI/esapi-java-legacy/compare/esapi-...esapi-2.7.0.0
105+
106+
for details. It contains all the information that the previous 'Developer Activity Reports' did and then some.
107+
108+
-----------------------------------------------------------------------------
109+
110+
CHANGELOG: Create your own. May I suggest:
111+
112+
git log --stat --since=2025-06-02 --reverse --pretty=medium
113+
114+
which will show all the commits since just after the previous (2.6.2.0) release.
115+
116+
Alternately, you can download the most recent ESAPI source and run
117+
118+
mvn site
119+
120+
which will create a CHANGELOG file named 'target/site/changelog.html'
121+
122+
123+
-----------------------------------------------------------------------------
124+
125+
Direct and Transitive Runtime and Test Dependencies:
126+
127+
$ mvn -B dependency:tree
128+
...
129+
[INFO] --- maven-dependency-plugin:3.8.1:tree (default-cli) @ esapi ---
130+
[INFO] org.owasp.esapi:esapi:jar:2.7.0.0-SNAPSHOT
131+
[INFO] +- javax.servlet:javax.servlet-api:jar:3.1.0:provided
132+
[INFO] +- javax.servlet.jsp:javax.servlet.jsp-api:jar:2.3.3:provided
133+
[INFO] +- xom:xom:jar:1.3.9:compile
134+
[INFO] +- commons-beanutils:commons-beanutils:jar:1.11.0:compile
135+
[INFO] | +- commons-logging:commons-logging:jar:1.3.5:compile
136+
[INFO] | \- commons-collections:commons-collections:jar:3.2.2:compile
137+
[INFO] +- commons-configuration:commons-configuration:jar:1.10:compile
138+
[INFO] +- commons-lang:commons-lang:jar:2.6:compile
139+
[INFO] +- commons-fileupload:commons-fileupload:jar:1.6.0:compile
140+
[INFO] +- org.apache.commons:commons-collections4:jar:4.5.0-M2:compile
141+
[INFO] +- org.apache-extras.beanshell:bsh:jar:2.0b6:compile
142+
[INFO] +- org.owasp.antisamy:antisamy:jar:1.7.8:compile
143+
[INFO] | +- commons-io:commons-io:jar:2.19.0:compile
144+
[INFO] | +- org.apache.httpcomponents.client5:httpclient5:jar:5.4.4:compile
145+
[INFO] | | \- org.apache.httpcomponents.core5:httpcore5-h2:jar:5.3.4:compile
146+
[INFO] | +- org.apache.httpcomponents.core5:httpcore5:jar:5.3.4:compile
147+
[INFO] | +- org.apache.xmlgraphics:batik-css:jar:1.19:compile
148+
[INFO] | | +- org.apache.xmlgraphics:batik-shared-resources:jar:1.19:compile
149+
[INFO] | | +- org.apache.xmlgraphics:batik-util:jar:1.19:compile
150+
[INFO] | | | +- org.apache.xmlgraphics:batik-constants:jar:1.19:compile
151+
[INFO] | | | \- org.apache.xmlgraphics:batik-i18n:jar:1.19:compile
152+
[INFO] | | \- org.apache.xmlgraphics:xmlgraphics-commons:jar:2.11:compile
153+
[INFO] | +- org.htmlunit:neko-htmlunit:jar:4.11.0:compile
154+
[INFO] | +- xerces:xercesImpl:jar:2.12.2:compile
155+
[INFO] | \- xml-apis:xml-apis-ext:jar:1.3.04:compile
156+
[INFO] +- org.slf4j:slf4j-api:jar:2.0.16:compile
157+
[INFO] +- xml-apis:xml-apis:jar:1.4.01:compile
158+
[INFO] +- com.github.spotbugs:spotbugs-annotations:jar:4.9.3:compile (optional)
159+
[INFO] | \- com.google.code.findbugs:jsr305:jar:3.0.2:compile (optional)
160+
[INFO] +- commons-codec:commons-codec:jar:1.17.1:test
161+
[INFO] +- junit:junit:jar:4.13.2:test
162+
[INFO] +- org.bouncycastle:bcprov-jdk18on:jar:1.78.1:test
163+
[INFO] +- org.hamcrest:hamcrest-core:jar:2.2:test
164+
[INFO] | \- org.hamcrest:hamcrest:jar:2.2:test
165+
[INFO] +- org.powermock:powermock-api-mockito2:jar:2.0.9:test
166+
[INFO] | \- org.powermock:powermock-api-support:jar:2.0.9:test
167+
[INFO] +- org.mockito:mockito-core:jar:3.12.4:test
168+
[INFO] | +- net.bytebuddy:byte-buddy:jar:1.11.13:test
169+
[INFO] | +- net.bytebuddy:byte-buddy-agent:jar:1.11.13:test
170+
[INFO] | \- org.objenesis:objenesis:jar:3.2:test
171+
[INFO] +- org.powermock:powermock-core:jar:2.0.9:test
172+
[INFO] | \- org.javassist:javassist:jar:3.27.0-GA:test
173+
[INFO] +- org.powermock:powermock-module-junit4:jar:2.0.9:test
174+
[INFO] | \- org.powermock:powermock-module-junit4-common:jar:2.0.9:test
175+
[INFO] +- org.powermock:powermock-reflect:jar:2.0.9:test
176+
[INFO] \- org.openjdk.jmh:jmh-core:jar:1.37:test
177+
[INFO] +- net.sf.jopt-simple:jopt-simple:jar:5.0.4:test
178+
[INFO] \- org.apache.commons:commons-math3:jar:3.6.1:test
179+
[INFO] ------------------------------------------------------------------------
180+
181+
-----------------------------------------------------------------------------
182+
183+
Acknowledgments:
184+
A whole bunch of folks to thank this time:
185+
- Longlong Gong (uglory-gll) - The security researcher who discovered the vulnerability that became CVE-2025-5878.
186+
Most people curse those who find CVEs in their software, but because of Longlong's work, we feel ESAPI is a better library and has a more secure future. (See the "Lessons Learned" section of Security Bulletin #13 for an explanation.)
187+
- The VulDB CNA team.
188+
- In no particular order, Jeff Williams, Matt Seil, Jeremiah Stacey, Erika von Kampen, Bill Sempf, and Ken Pyle, all who provided me with excellent feedback on the documentation and code changes and help me keep my sanity for the past 3 weeks.
189+
- My wife for tolerating my long evenings for the past 3 weeks. I know I've been cranky and it's been stressful for us both, but thanks for being so understanding and supportive.
190+
- And finally, thanks to all the ESAPI users who make this worthwhile. This is for you.
191+
192+
A special thanks to the ESAPI community from the ESAPI project co-leaders:
193+
Kevin W. Wall (kwwall) <== The irresponsible party for these release notes!
194+
Matt Seil (xeno6696)

0 commit comments

Comments
 (0)