Struts2 CVE-2017-5638

[Ping Zhou]

Hi,

I'm going to patch 8 in several months. Does 2.2.0.470 with Patch 8 deployment still need Struts2 CVE-2017-5638 fix, aka "ise-applystrutsfix-signed.x86_64.tar.gz"?

Thanks.

[hslai · Accepted solution]

No, not needed. The CVE is associated with CSCvd49829 and the fix has been integrated into 2.2 Patch 1.