Talend Open Studio: Release Scehdule

[Jlucas]

Hi Community,

I am working with Talend Open Studio for Windows. I am trying to address

CVE-2022-42889.

I was wondering is there anyway to know when the next release of Open Studio will be released where this vulnerability is address by having an upgraded jar?

I tried upgrading the Apache Commons Text jar myself, but my jobs will no longer build and product and error for a missing class path. Is there a way to resolve this if there are no recent open studio releases coming?

Thank you

[Anonymous]

Hello,

Talend is aware of and monitoring CVE-2022-42889 (Apache Commons Text aka Text4Shell) security vulnerability.

Mitigations for the vulnerability were implemented in Talend Cloud on October 20, 2022 with no observed impact as a result of the vulnerability prior to implementing the mitigations.

Talend is scoping the remediation efforts throughout its Product portfolio and is in the process of developing the code fix to address the impacted Products.

Please see https://www.talend.com/security/incident-response/

I’m afraid we do not supply patches for the Open Studio releases. We only provide patches for our subscription products.

We will keep you posted as long as there is any information about the next release of Open Studio.

Really sorry for the inconvenience.

Best regards

Sabrina

[Jlucas]

Thanks for the response xdshi!

Ah I understand that is unfortunate. Do you have any documentation on how to properly update the apache commons jar in open studio?

[Anonymous]

Hello,

So far, there is no documentation for updating the Apache commons jar.

Please find the latest information on CVE-2022-42889

https://www.talend.com/security/incident-response/#CVE-2022-42889

The Apache Security team have released a statement to clarify the impact of CVE-2022-42889: https://blogs.apache.org/security/entry/cve-2022-42889

"This issue is different from Log4Shell (CVE-2021-44228) because in Log4Shell, string interpolation was possible from the log message body, which commonly contains untrusted input. In the Apache Common Text issue, the relevant method is explicitly intended and clearly documented to perform string interpolation, so it is much less likely that applications would inadvertently pass in untrusted input without proper validation."

Best regards

Sabrina