An update for apache-commons-io is now available for openEuler-20.03-LTS-SP1 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2021-1182 Final 1.0 1.0 2021-05-15 Initial 2021-05-15 2021-05-15 openEuler SA Tool V1.0 2021-05-15 apache-commons-io security update An update for apache-commons-io is now available for openEuler-20.03-LTS-SP1. Apache commons IO library is used for developing IO functionality. It contains a collecton of utilities with utility classes, stream implementations, file filters, file comparators, endian transformation classes, and much more. Security Fix(es): In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like //../foo , or .. foo , the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus limited path traversal), if the calling code would use the result to construct a path value.(CVE-2021-29425) An update for apache-commons-io is now available for openEuler-20.03-LTS-SP1. openEuler Security has rated this update as having a security impact of medium. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. Medium apache-commons-io https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1182 https://openeuler.org/en/security/cve/detail.html?id=CVE-2021-29425 https://nvd.nist.gov/vuln/detail/CVE-2021-29425 openEuler-20.03-LTS-SP1 apache-commons-io-2.6-7.oe1.noarch.rpm apache-commons-io-help-2.6-7.oe1.noarch.rpm apache-commons-io-2.6-7.oe1.src.rpm In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like //../foo , or .. foo , the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus limited path traversal), if the calling code would use the result to construct a path value. 2021-05-15 CVE-2021-29425 openEuler-20.03-LTS-SP1 Medium 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N apache-commons-io security update 2021-05-15 https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1182