You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@activemq.apache.org by "ASF subversion and git services (JIRA)" <ji...@apache.org> on 2019/07/16 16:57:00 UTC
[jira] [Commented] (ARTEMIS-2363) spring-core-5.0.1.RELEASE.jar
vulnerable to CVE-2018-15756
[ https://issues.apache.org/jira/browse/ARTEMIS-2363?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16886297#comment-16886297 ]
ASF subversion and git services commented on ARTEMIS-2363:
----------------------------------------------------------
Commit af12cd7fdff82d7482009f5c0ee84d2540c21845 in activemq-artemis's branch refs/heads/master from Justin Graham Bertram
[ https://gitbox.apache.org/repos/asf?p=activemq-artemis.git;h=af12cd7 ]
ARTEMIS-2363 upgrade Spring dependency
> spring-core-5.0.1.RELEASE.jar vulnerable to CVE-2018-15756
> ----------------------------------------------------------
>
> Key: ARTEMIS-2363
> URL: https://issues.apache.org/jira/browse/ARTEMIS-2363
> Project: ActiveMQ Artemis
> Issue Type: Wish
> Components: Broker
> Affects Versions: 2.8.1
> Reporter: Albert Baker
> Assignee: Justin Bertram
> Priority: Minor
> Labels: build, easyfix, security
> Original Estimate: 2h
> Time Spent: 10m
> Remaining Estimate: 1h 50m
>
> Please upgrade the vulnerabile third party libraies that are used with Apache ActiveMQ Artimis
> Dependency CPE Highest Severity CVE Count CPE Confidence
> ----------------------------------|----------------------------------------------|--------------------|---------------|-----------------------
> spring-core-5.0.1.RELEASE.jar cpe:/a:springsource:spring_framework:5.0.1 High 8 Highest
> https://nvd.nist.gov/vuln/detail/CVE-2018-15756
> Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older that depend on spring-boot-starter-web or spring-boot-starter-webflux are ready to serve static resources out of the box and are therefore vulnerable.
> Mitigation : Spring-core-5.0.1 is from Oct 2017, the latetst 5..1.7 is from May 2019
--
This message was sent by Atlassian JIRA
(v7.6.14#76016)