You are viewing a plain text version of this content. The canonical link for it is here.
Posted to gitbox@activemq.apache.org by "cloudtracer (via GitHub)" <gi...@apache.org> on 2026/05/07 13:58:06 UTC
[I] jasypt version 1.9.3 is vulnerable to CVE-2022-22965 [activemq]
cloudtracer opened a new issue, #1997:
URL: https://github.com/apache/activemq/issues/1997
Can this dependency be updated? Its vulnerable to a a number of old CVEs some of which are rated high.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@activemq.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@activemq.apache.org
For additional commands, e-mail: gitbox-help@activemq.apache.org
For further information, visit: https://activemq.apache.org/contact
Re: [I] jasypt version 1.9.3 is vulnerable to CVE-2022-22965 [activemq]
Posted by "cloudtracer (via GitHub)" <gi...@apache.org>.
cloudtracer commented on issue #1997:
URL: https://github.com/apache/activemq/issues/1997#issuecomment-4397818071
Thanks for the fast response @jbonofre but 1.9.3 is a vulnerable version. You can see all the vulnerabilities with this dependency on mvnrepository : https://mvnrepository.com/artifact/org.jasypt/jasypt-spring4/1.9.3
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@activemq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@activemq.apache.org
For additional commands, e-mail: gitbox-help@activemq.apache.org
For further information, visit: https://activemq.apache.org/contact
Re: [I] jasypt version 1.9.3 is vulnerable to CVE-2022-22965 [activemq]
Posted by "jbonofre (via GitHub)" <gi...@apache.org>.
jbonofre closed issue #1997: jasypt version 1.9.3 is vulnerable to CVE-2022-22965
URL: https://github.com/apache/activemq/issues/1997
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@activemq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@activemq.apache.org
For additional commands, e-mail: gitbox-help@activemq.apache.org
For further information, visit: https://activemq.apache.org/contact
Re: [I] jasypt version 1.9.3 is vulnerable to CVE-2022-22965 [activemq]
Posted by "jbonofre (via GitHub)" <gi...@apache.org>.
jbonofre commented on issue #1997:
URL: https://github.com/apache/activemq/issues/1997#issuecomment-4397837109
Oh sorry, I thought you asked to update to 1.9.3.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@activemq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@activemq.apache.org
For additional commands, e-mail: gitbox-help@activemq.apache.org
For further information, visit: https://activemq.apache.org/contact
Re: [I] jasypt version 1.9.3 is vulnerable to CVE-2022-22965 [activemq]
Posted by "mattrpav (via GitHub)" <gi...@apache.org>.
mattrpav commented on issue #1997:
URL: https://github.com/apache/activemq/issues/1997#issuecomment-4792582626
I’m in favor of replacing it. jasypt is such a thin wrapper anyway. More work to maintain it than a simple hash utility
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@activemq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@activemq.apache.org
For additional commands, e-mail: gitbox-help@activemq.apache.org
For further information, visit: https://activemq.apache.org/contact
Re: [I] jasypt version 1.9.3 is vulnerable to CVE-2022-22965 [activemq]
Posted by "davhaus (via GitHub)" <gi...@apache.org>.
davhaus commented on issue #1997:
URL: https://github.com/apache/activemq/issues/1997#issuecomment-5482751159
Still relevant.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@activemq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@activemq.apache.org
For additional commands, e-mail: gitbox-help@activemq.apache.org
For further information, visit: https://activemq.apache.org/contact
Re: [I] jasypt version 1.9.3 is vulnerable to CVE-2022-22965 [activemq]
Posted by "davhaus (via GitHub)" <gi...@apache.org>.
davhaus commented on issue #1997:
URL: https://github.com/apache/activemq/issues/1997#issuecomment-4792183715
Does applicability of a given CVE matter? jasypt is EOL as of last fall with the last release published 6 years ago. That alone is a critical finding in some settings and can only be addressed by outright replacement.
https://github.com/jasypt/jasypt:
<img width="676" height="52" alt="Image" src="https://github.com/user-attachments/assets/68d19ab3-469c-438e-97d3-422163847f6e" />
...
<img width="1050" height="193" alt="Image" src="https://github.com/user-attachments/assets/27fea431-a7a7-4e3f-84bf-d01050601e34" />
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@activemq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@activemq.apache.org
For additional commands, e-mail: gitbox-help@activemq.apache.org
For further information, visit: https://activemq.apache.org/contact
Re: [I] jasypt version 1.9.3 is vulnerable to CVE-2022-22965 [activemq]
Posted by "jbonofre (via GitHub)" <gi...@apache.org>.
jbonofre commented on issue #1997:
URL: https://github.com/apache/activemq/issues/1997#issuecomment-4397848367
Let me do an analyse to see if the CVEs actually applicable in ActiveMQ context.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@activemq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@activemq.apache.org
For additional commands, e-mail: gitbox-help@activemq.apache.org
For further information, visit: https://activemq.apache.org/contact
Re: [I] jasypt version 1.9.3 is vulnerable to CVE-2022-22965 [activemq]
Posted by "jbonofre (via GitHub)" <gi...@apache.org>.
jbonofre commented on issue #1997:
URL: https://github.com/apache/activemq/issues/1997#issuecomment-4397775865
Already updated: https://github.com/apache/activemq/blob/main/pom.xml#L72
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@activemq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@activemq.apache.org
For additional commands, e-mail: gitbox-help@activemq.apache.org
For further information, visit: https://activemq.apache.org/contact
Re: [I] jasypt version 1.9.3 is vulnerable to CVE-2022-22965 [activemq]
Posted by "mattrpav (via GitHub)" <gi...@apache.org>.
mattrpav commented on issue #1997:
URL: https://github.com/apache/activemq/issues/1997#issuecomment-5486193720
I'll try to pull this into 6.4.0 and be done w/ jasypt.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@activemq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@activemq.apache.org
For additional commands, e-mail: gitbox-help@activemq.apache.org
For further information, visit: https://activemq.apache.org/contact
Re: [I] jasypt version 1.9.3 is vulnerable to CVE-2022-22965 [activemq]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on issue #1997:
URL: https://github.com/apache/activemq/issues/1997#issuecomment-5448308595
This issue is stale because it has been open 60 days with no activity. Remove stale label or comment if you think it's still relevant.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@activemq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@activemq.apache.org
For additional commands, e-mail: gitbox-help@activemq.apache.org
For further information, visit: https://activemq.apache.org/contact