Skip to:

Skip to Jira Navigation
Skip to Side Navigation
Skip to Main Content

update metadata-extractor in image extension to 2.18.0 due to CVE

Description

Latest is https://mvnrepository.com/artifact/com.drewnoakes/metadata-extractor/2.18.0

we are using 2.8.1

https://github.com/drewnoakes/metadata-extractor/releases

needs osgi bundling

Environment

None

Linked issues

relates to

Many vulnerable libs in Lucee preventing use in Government shops

Update image extension to v2 for Lucee 5.4

Activity

Show:

Zac Spitzer 29 November 2022 at 16:25

https://github.com/lucee/Lucee/commit/7c2398f926a3febd6f9a122547eb36469ab04392

Pothys - MitrahSoft 29 November 2022 at 11:43

I added a testcase to imageGetEXIFMetadata()

Pull Request: https://github.com/lucee/Lucee/pull/1884

Zac Spitzer 29 November 2022 at 08:53

https://github.com/lucee/extension-image/commit/69219d3b923843047f980886f3980192d6de7118

Michael Offner 28 November 2022 at 15:33

@Pothys - MitrahSoft can you please add a test case specific for image metadata.

Zac Spitzer 24 November 2022 at 15:25

I’ve asked them to add OSGI metadata too https://github.com/drewnoakes/metadata-extractor/issues/593

Fixed

Details
Assignee
Michael Offner
Reporter
Zac Spitzer
Priority
New
Labels
Imagejavasecurity
Fix versions
5.4.0.2-SNAPSHOT
Image 2.0.0.17
New Issue warning screen
Before you create a new Issue, please post to the mailing list first https://dev.lucee.org
Once the issue has been verified, one of the Lucee team will ask you to file an issue

Created 22 November 2022 at 09:08

Updated 14 December 2022 at 17:41

Resolved 14 December 2022 at 17:41