# CVE-2022-42889 by opensearch

**URL:** <https://forum.opensearch.org/t/cve-2022-42889-by-opensearch/11256>\
**Category:** OpenSearch\
**Tags:** cve, security-issue\
**Created:** [October 19, 2022, 7:37am UTC](https://forum.opensearch.org/t/cve-2022-42889-by-opensearch/11256 "2022-10-19T07:37:30Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![speechkey](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/speechkey/32/4325_2.png) [@speechkey](https://forum.opensearch.org/u/speechkey)\
**Post date:** [October 19, 2022, 7:37am UTC](https://forum.opensearch.org/t/cve-2022-42889-by-opensearch/11256/1 "2022-10-19T07:37:30Z")

</div>

Hi folks,

as I can see, the last versions of opensearch 1 and opensearch 2 contains `org.apache.commons.commons-text` Java library in version \< 1.10.0 which is vulnerable agains [NVD - CVE-2022-42889](https://nvd.nist.gov/vuln/detail/CVE-2022-42889). Is theare any hotfix?

best regards  
-s

---

<div class="post-metadata">

**Author:** ![kris](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/kris/32/2208_2.png) [@kris](https://forum.opensearch.org/u/kris)\
**Post date:** [October 24, 2022, 7:52pm UTC](https://forum.opensearch.org/t/cve-2022-42889-by-opensearch/11256/2 "2022-10-24T19:52:57Z")

</div>

Hello @speechkey - welcome to the OpenSearch community. Good question - let me follow up with the engineering team and we’ll get a reply back out on this.

---

<div class="post-metadata">

**Author:** ![kris](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/kris/32/2208_2.png) [@kris](https://forum.opensearch.org/u/kris)\
**Post date:** [October 24, 2022, 11:49pm UTC](https://forum.opensearch.org/t/cve-2022-42889-by-opensearch/11256/3 "2022-10-24T23:49:27Z")

</div>

Hello @speechkey - I spoke with @davelago (SDM, OpenSeach) and he confirmed: Thank you for your message about the CVEs reported in OpenSearch versions 1 and 2. After a thorough review we have determined these versions are not impacted by CVE-2022-42889.

---

<div class="post-metadata">

**Author:** ![Krystal](https://avatars.discourse-cdn.com/v4/letter/k/f08c70/32.png) [@Krystal](https://forum.opensearch.org/u/Krystal)\
**Post date:** [October 26, 2022, 2:37pm UTC](https://forum.opensearch.org/t/cve-2022-42889-by-opensearch/11256/4 "2022-10-26T14:37:47Z")

</div>

Hello @kris - I was wondering if your response indicates that none of version 1 or 2 of OpenSearch are vulnerable, or if you were just speaking about the latest version of the software.  
Thank you!

---

<div class="post-metadata">

**Author:** ![speechkey](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/speechkey/32/4325_2.png) [@speechkey](https://forum.opensearch.org/u/speechkey)\
**Post date:** [October 27, 2022, 2:45pm UTC](https://forum.opensearch.org/t/cve-2022-42889-by-opensearch/11256/5 "2022-10-27T14:45:47Z")

</div>

> [@kris](#):
>
> Hello @speechkey - I spoke with @davelago (SDM, OpenSeach) and he confirmed: Thank you for your message about the CVEs reported in OpenSearch versions 1 and 2. After a thorough review we have determined these versions are not impacted by CVE-2022-42889.

Hi @kris, thank you for your feedback.

---

<div class="post-metadata">

**Author:** ![kris](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/kris/32/2208_2.png) [@kris](https://forum.opensearch.org/u/kris)\
**Post date:** [October 27, 2022, 4:31pm UTC](https://forum.opensearch.org/t/cve-2022-42889-by-opensearch/11256/6 "2022-10-27T16:31:58Z")

</div>

@Krystal welcome to the OpenSearch community! Correct, none of the versions are.