You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@rocketmq.apache.org by "leon8693 (via GitHub)" <gi...@apache.org> on 2024/08/14 05:57:31 UTC
[I] [漏洞报告] Rocketmq 5.3.0最新版本中有tomcat-embed-core-8.5.46.jar 存在漏洞 [rocketmq]
leon8693 opened a new issue, #8531:
URL: https://github.com/apache/rocketmq/issues/8531
### Is Your Feature Request Related to a Problem?
公司安全扫描出Rocketmq 5.3.0 最新版本中有tomcat-embed-core-8.5.46.jar 属于漏洞范围
详细信息如下
tomcat-embed-core
安装包路径:
/home/rocketmq/rocketmq-5.3.0/lib/tomcat-embed-core-8.5.46.jar
当前版本:
8.5.46
存在漏洞版本:
>=8.5.7，<8.5.64
修复版本:
8.5.64
参考链接
https://avd.aliyun.com/detail?id=AVD-2024-21733
现在用的是 apache/rocketmq:5.3.0 镜像
但是在 rocketmq-all-5.3.0-bin-release.zip 文件中
同样存在
### Describe the Solution You'd Like
希望临时和永久的解决办法
1. 有什么办法临时解决
2. 能否下个版本固定升级到无漏洞版本
### Describe Alternatives You've Considered
我暂时没办法
### Additional Context
_No response_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [漏洞报告] Rocketmq 5.3.0最新版本中有tomcat-embed-core-8.5.46.jar 存在漏洞 [rocketmq]
Posted by "leon8693 (via GitHub)" <gi...@apache.org>.
leon8693 commented on issue #8531:
URL: https://github.com/apache/rocketmq/issues/8531#issuecomment-2290558736
测试过,可以,谢谢~
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [漏洞报告] Rocketmq 5.3.0最新版本中有tomcat-embed-core-8.5.46.jar 存在漏洞 [rocketmq]
Posted by "yuz10 (via GitHub)" <gi...@apache.org>.
yuz10 commented on issue #8531:
URL: https://github.com/apache/rocketmq/issues/8531#issuecomment-2288316903
+- io.jaegertracing:jaeger-thrift:jar:1.6.0:compile
| \- org.apache.thrift:libthrift:jar:0.14.1:compile
| +- org.apache.tomcat.embed:tomcat-embed-core:jar:8.5.46:compile
| | \- org.apache.tomcat:tomcat-annotations-api:jar:8.5.46:compile
| \- javax.annotation:javax.annotation-api:jar:1.3.2:compile
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [漏洞报告] Rocketmq 5.3.0最新版本中有tomcat-embed-core-8.5.46.jar 存在漏洞 [rocketmq]
Posted by "RongtongJin (via GitHub)" <gi...@apache.org>.
RongtongJin closed issue #8531: [漏洞报告] Rocketmq 5.3.0最新版本中有tomcat-embed-core-8.5.46.jar 存在漏洞
URL: https://github.com/apache/rocketmq/issues/8531
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [漏洞报告] Rocketmq 5.3.0最新版本中有tomcat-embed-core-8.5.46.jar 存在漏洞 [rocketmq]
Posted by "leizhiyuan (via GitHub)" <gi...@apache.org>.
leizhiyuan commented on issue #8531:
URL: https://github.com/apache/rocketmq/issues/8531#issuecomment-2289982027
这个maven依赖看着是测试module使用的，临时可以在lib中移除这个jar即可，不会影响功能，后续升级之后，项目中不会再存在。
This maven dependency looks like it is used by the test module, and this jar can be removed from the lib temporarily, which will not affect the function, and will no longer exist in the project after subsequent upgrades
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org