You are viewing a plain text version of this content. The canonical link for it is here.

Posted to commits@tomee.apache.org by "Pavana Sai Mahathi Vavilala (Jira)" <ji...@apache.org> on 2023/11/01 08:58:00 UTC

[jira] [Created] (TOMEE-4270) TomEE plus is affected by CVE-2023-46604 vulnerability

Pavana Sai Mahathi Vavilala created TOMEE-4270:
--------------------------------------------------

             Summary: TomEE plus is affected by CVE-2023-46604 vulnerability 
                 Key: TOMEE-4270
                 URL: https://issues.apache.org/jira/browse/TOMEE-4270
             Project: TomEE
          Issue Type: Bug
    Affects Versions: 9.1.0
            Reporter: Pavana Sai Mahathi Vavilala


TomEE plus (version 9.1.0) is using Apache ActiveMQ which is affected by RCE vulnerability CVE-2023-46604 with CVSS score of 10.


Please confirm if this vulnerability impacts version (9.1.0 or later)?

Our product does not use the ActiveMQ broker/client. Can we remove the ActiveMQ specific components as a remediation without adversly affecting TomEE?

Please let us know when we upgrade TomEE to official fix to address this issue.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)