You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@activemq.apache.org by "ASF GitHub Bot (Jira)" <ji...@apache.org> on 2022/02/02 15:36:00 UTC
[jira] [Work logged] (ARTEMIS-2413) Upgrade JGroups
[ https://issues.apache.org/jira/browse/ARTEMIS-2413?focusedWorklogId=719455&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-719455 ]
ASF GitHub Bot logged work on ARTEMIS-2413:
-------------------------------------------
Author: ASF GitHub Bot
Created on: 02/Feb/22 15:35
Start Date: 02/Feb/22 15:35
Worklog Time Spent: 10m
Work Description: gemmellr commented on a change in pull request #3934:
URL: https://github.com/apache/activemq-artemis/pull/3934#discussion_r797720233
##########
File path: docs/user-manual/en/using-jms.md
##########
@@ -170,9 +170,8 @@ Lastly, the `jgroups` scheme is supported which provides an alternative to the
`udp` scheme for server discovery. The URL pattern is either
`jgroups://channelName?file=jgroups-xml-conf-filename`
where`jgroups-xml-conf-filename` refers to an XML file on the classpath that
-contains the JGroups configuration or it can be
-`jgroups://channelName?properties=some-jgroups-properties`. In both instance
-the `channelName` is the name given to the jgroups channel created.
+contains the JGroups configuration. The `channelName` is the name given to the
Review comment:
The start of the earlier sentence also needs updated as it is no longer 'either'.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@activemq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Issue Time Tracking
-------------------
Worklog Id: (was: 719455)
Time Spent: 20m (was: 10m)
> Upgrade JGroups
> ---------------
>
> Key: ARTEMIS-2413
> URL: https://issues.apache.org/jira/browse/ARTEMIS-2413
> Project: ActiveMQ Artemis
> Issue Type: Task
> Affects Versions: 2.6.4
> Reporter: Endre Jeges
> Priority: Major
> Time Spent: 20m
> Remaining Estimate: 0h
>
> I have noticed with the OWASP dependency-check plugin (org.owasp:dependency-check-maven:5.0.0) that the currently used org.jgroups:jgroups:3.6.13.Final has a [CWE-300: Channel Accessible by Non-Endpoint ('Man-in-the-Middle')|https://ossindex.sonatype.org/vuln/7c83fdab-9665-4e79-bc81-cc67fbb96417] vulnerability. The problem has not been reported in the NVD database, therefore there is no CVE record.
> The vulnerability has been [addressed|https://github.com/belaban/JGroups/pull/348] in version org.jgroups:jgroups:4.0.2.Final (at the moment the latest version is org.jgroups:jgroups:4.1.1.Final).
> The org.jgroups:jgroups dependency would require an upgrade to resolve the vulnerability.
>
--
This message was sent by Atlassian Jira
(v8.20.1#820001)