Advisories for Maven/Org.omnifaces/Omnifaces package

1. Forged combined-resource IDs CombinedResourceInfo accepts a path-derived ID without an authenticity check, inflates it without an output limit, converts it to attacker-selected resource identifiers, and retains unique IDs in an unbounded static cache. In bounded tests, 20,754 encoded bytes inflated to 16,000,000 characters (about 770:1; about 49 MB observed heap delta), and 200 unique IDs added 200 permanent cache entries. A legitimately shaped short ID remained about 1:1, while …

Server-side EL injection leading to Remote Code Execution (RCE). Affects applications that use CDNResourceHandler with a wildcard CDN mapping (e.g. libraryName:=https://cdn.example.com/). An attacker can craft a resource request URL containing an EL expression in the resource name, which is evaluated server-side. The severity depends on the EL implementation and the objects available in the EL context. In the worst case this leads to Remote Code Execution (RCE). At minimum it …

This advisory has been withdrawn.