Nobody familiar with Java would interpret it this way. Also it's probably correct. There are vulnerabilities lurking in all software of any size and functionality, and Apache Commons is no exception.
Nobody familiar with Java would interpret it this way. Also it's probably correct. There are vulnerabilities lurking in all software of any size and functionality, and Apache Commons is no exception.
If the vulnerability is just in one component, it is important to be specific about which one it is.
Does anyone know what depends on Commons Text?
Edit: "Artifacts using Apache Commons Text" according to Maven:
https://mvnrepository.com/artifact/org.apache.commons/common...
There are some well-known projects that might be impacted: Hadoop, Spark, Velocity, Hive, Solr, and many more.
When I read the title in the morning I had a short moment of panic because we make extensive use of for example Apache Commons Collections in our projects. Updating these libraries and delivering the fixes to customers would have resulted in quite some work.
If the title would have been more accurate it would probably have saved me from a mini heart-attack in the morning.