# Apache Commons Text vulnerability CVE-2022-42889

**URL:** <https://community.jenkins.io/t/apache-commons-text-vulnerability-cve-2022-42889/4258>\
**Category:** Ask a question\
**Created:** [October 21, 2022, 7:27am UTC](https://community.jenkins.io/t/apache-commons-text-vulnerability-cve-2022-42889/4258 "2022-10-21T07:27:05Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![hafees](https://avatars.discourse-cdn.com/v4/letter/h/48db29/32.png) [@hafees](https://community.jenkins.io/u/hafees)\
**Post date:** [October 21, 2022, 7:27am UTC](https://community.jenkins.io/t/apache-commons-text-vulnerability-cve-2022-42889/4258/1 "2022-10-21T07:27:05Z")

</div>

Does the vulnerability CVE-2022-42889 a.k.a Text4shell affects Jenkins

---

<div class="post-metadata">

**Author:** ![NotMyFault](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/notmyfault/32/466_2.png) [@NotMyFault](https://community.jenkins.io/u/NotMyFault)\
**Post date:** [October 21, 2022, 8:39am UTC](https://community.jenkins.io/t/apache-commons-text-vulnerability-cve-2022-42889/4258/2 "2022-10-21T08:39:49Z")

</div>

Quoting @wfollonier’s reply from [Jira](https://issues.jenkins.io/browse/JENKINS-69877?focusedCommentId=431518&page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#comment-431518):

```nohighlight
For your information, the security team invested some time assessing this CVE. The conclusion is that no plugin in the Jenkins ecosystem is impacted.
This means that updating that dependency is only to comply with scanners, not for security reasons.

```

---

<div class="post-metadata">

**Author:** ![wfollonier](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/wfollonier/32/164_2.png) [@wfollonier](https://community.jenkins.io/u/wfollonier)\
**Post date:** [October 21, 2022, 9:35am UTC](https://community.jenkins.io/t/apache-commons-text-vulnerability-cve-2022-42889/4258/3 "2022-10-21T09:35:43Z")

</div>

@hafees We have a [process](https://www.jenkins.io/security/reporting/) for reporting vulnerabilities. This is the preferred way to discuss about vulnerabilities. Doing that in public is not a good idea by default.

Thanks Alex for the quote.

Now just to be explicit, I do not plan to publish a blog post about the vulnerability, as it was explained by Apache directly, the requirements to be impacted are not as common as for Log4Shell, despite the critical score.

---

<div class="post-metadata">

**Author:** ![halkeye](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/halkeye/32/8_2.png) [@halkeye](https://community.jenkins.io/u/halkeye)\
**Post date:** [October 21, 2022, 4:36pm UTC](https://community.jenkins.io/t/apache-commons-text-vulnerability-cve-2022-42889/4258/4 "2022-10-21T16:36:07Z")

</div>

Closed on October 21, 2022, 4:36pm UTC