[jira] [Commented] (AMQ-6996) ActiveMQ 5.15.4 xercesImpl-2.11.0.jar which has one high severity CVE against it.

["Albert Baker (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/AMQ-6996?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16515761#comment-16515761 ] 

Albert Baker commented on AMQ-6996:
-----------------------------------

2.12 exists here :

[http://apache.mirrors.hoobly.com//xerces/j/binaries/Xerces-J-bin.2.12.0.tar.gz]

Its unclear if replacing 2.11 w/ 2.12 will pass the build tests.

Its unclear if there may be other weird inter-depencecy issues within the rest of the libraries.

I would hope that the ActiveMQ team took these thrd party dependency issues on instead of every user having to patch the build.

> ActiveMQ 5.15.4 xercesImpl-2.11.0.jar which has one high severity CVE against it.
> ---------------------------------------------------------------------------------
>
>                 Key: AMQ-6996
>                 URL: https://issues.apache.org/jira/browse/AMQ-6996
>             Project: ActiveMQ
>          Issue Type: Bug
>          Components: Broker, webconsole
>    Affects Versions: 5.15.4
>         Environment: Environment: Customer environment is a mix of Linux and Windows, Gig-LAN (Medical & Finacial services).  Will not accept the risk of having even one high severity CVE in thier environment. The cost of (SOX/HIPPA) insurence is too high to allow even one CVE with newly deployed systems.
>            Reporter: Albert Baker
>            Priority: Blocker
>
> ActiveMQ 5.15.4 xercesImpl-2.11.0.jar which has one high severity CVE against it.
> Discovered by adding OWASP Dependency check into ActiveMQ pom.xml and running the OWASP report.
> CVE-2012-0881 Severity:High  CVSS Score: 7.8 (AV:N/AC:L/Au:N/C:N/I:N/A:C)
> CWE: CWE-399 Resource Management Errors
> Apache Xerces2 Java allows remote attackers to cause a denial of service (CPU consumption) via a crafted message to an XML service, which triggers hash table collisions.
> CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=787104
> MLIST - [oss-security] 20140708 Summer bug cleaning - some Hash DoS stuff
> Vulnerable Software & Versions:
> cpe:/a:apache:xerces2_java:2.11.0 and all previous versions



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)