Is EJBCA vulnerable to CVE-2022-42889?

[eryabies]

Hi!

Is EJBCA vulnerable to CVE-2022-42889?

Thanks

[mike-agrenius-kushner]

Hi,

While EJBCA is currently still on version 1.9, we don't use the text interpolation feature mentioned in the CVE, so EJBCA is not at direct risk, but commons-text is scheduled to be updated in the next release.

Cheers,
Mike