TIBCO is aware of the recently announced Apache Commons Text vulnerability (CVE-2022-42889), referred to as “Text4Shell”.

For more information about the general TIBCO investigation into this, please refer to Apache Commons Text Vulnerability & JXPath.

This article provides additional information on how TIBCO Offer and Price Engine in particular are affected.

As an immediate fix to mitigate this issue, users can follow these steps:

• Take the backup of commons-text-1.6.jar from the directory ope/5.1/roles/ope/standalone/lib
• Stop ope-core and shopping cart services
• Delete  commons-text-1.6.jar from ope/5.1/roles/ope/standalone/lib and ope/5.1/roles/shoppingcart/standalone/lib
• Restart ope-core and shoppingcart services

TIBCO Public Notice about Apache Commons Text Vulnerability & JXPath - https://www.tibco.com/support/notices/2022/10/apache-commons-text-vulnerability-jxpath