Apache Struts2 Core Integer Overflow
Apache Struts2 Core up to version 7.4.0 fails to prevent integer overflows that cause wrap-arounds on downstream casting to types smaller than BigInteger.
Apache Struts2 Core version 7.4.0 and below has an integer overflow issue that leads to wrap-arounds and problems when casting to smaller types. The report stresses that applications should perform their own input validation rather than rely on the upstream code. No exploitation or patches are mentioned.
- Affected versions: Apache Struts2 Core 7.4.0 and below.
- Overflows result in wrap-arounds during type casting.
- Independent input validation recommended.
- Downstream casting to types smaller than BigInteger is impacted.
- Finding highlights upstream code limitations.
Impact: Integer overflow causing wrap-arounds and type casting errors
- 1.Perform own input validation checks
- 2.Do not assume upstream Struts2 code is secure
- Vendors
- Apache
- Products
- Struts2 Core
From the original article
Posted by Daniel Owens via Fulldisclosure on Nov 01 Description Apache Struts2 Core version 7. 4. 0 and below fails to properly prevent integer overflows, causing wrap-arounds and other issues on a downstream forced casting into types smaller than `BigInteger`.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.