EC2box may be vulnerable to Struts2 attack
ciarancourtney opened this issue · comments
Anyone running EC2box publically may want to turn it off as a precaution. I've seen signatures in my ec2box logs contingent to this attack.
https://www.mysonicwall.com/sonicalert/searchresults.aspx?ev=article&id=1013
From https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5638
I have already updated to 2.5.10.1 on master 2d98906
I just need to put a release out. I'll try and do that tonight! Thanks @ciarancourtney!
Done - https://github.com/skavanagh/EC2Box/releases/tag/v0.30.03
Thanks again @ciarancourtney!