You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@activemq.apache.org by "ASF GitHub Bot (Jira)" <ji...@apache.org> on 2022/01/31 15:18:00 UTC
[jira] [Work logged] (ARTEMIS-2413) Upgrade JGroups
[ https://issues.apache.org/jira/browse/ARTEMIS-2413?focusedWorklogId=717986&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-717986 ]
ASF GitHub Bot logged work on ARTEMIS-2413:
-------------------------------------------
Author: ASF GitHub Bot
Created on: 31/Jan/22 15:17
Start Date: 31/Jan/22 15:17
Worklog Time Spent: 10m
Work Description: jbertram opened a new pull request #3934:
URL: https://github.com/apache/activemq-artemis/pull/3934
JGroups 3.x hasn't been updated in some time now. The last release was
in April 2020 almost 2 years ago. Since then there's been 35 releases
from 4.x and 5.x. Lots of protocols have been updated and added and
users are wanting to use them. Multiple Jiras have been opened to
upgrade:
- https://issues.apache.org/jira/browse/ARTEMIS-2413
- https://issues.apache.org/jira/browse/ARTEMIS-2436
- https://issues.apache.org/jira/browse/ARTEMIS-3066
Notably, there is concern over the security of using older components
triggered mainly by the recent Log4Shell vulnerability discovered in
Log4j 2.x. The upgrade is meant to deal with all these issues.
However, there is a cost associated with upgrading.
The old-style properties configuration is no longer supported. I think
it's unlikely that end-users are leveraging this because it is not
exposed via broker.xml. The JGroups XML configuration has been around
for a long time, is widely adopted, and is still supported. I expect
most (if not all) users are using this. However, a handful of tests
needed to be updated and/or removed to deal with this absence.
Some protocols and/or protocol properties are no longer supported. This
means that users may have to change their JGroups stack configurations
when the upgrade. For example, our own clustered-jgroups example had to
be updated or it wouldn't run properly.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@activemq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Issue Time Tracking
-------------------
Worklog Id: (was: 717986)
Remaining Estimate: 0h
Time Spent: 10m
> Upgrade JGroups
> ---------------
>
> Key: ARTEMIS-2413
> URL: https://issues.apache.org/jira/browse/ARTEMIS-2413
> Project: ActiveMQ Artemis
> Issue Type: Task
> Affects Versions: 2.6.4
> Reporter: Endre Jeges
> Priority: Major
> Time Spent: 10m
> Remaining Estimate: 0h
>
> I have noticed with the OWASP dependency-check plugin (org.owasp:dependency-check-maven:5.0.0) that the currently used org.jgroups:jgroups:3.6.13.Final has a [CWE-300: Channel Accessible by Non-Endpoint ('Man-in-the-Middle')|https://ossindex.sonatype.org/vuln/7c83fdab-9665-4e79-bc81-cc67fbb96417] vulnerability. The problem has not been reported in the NVD database, therefore there is no CVE record.
> The vulnerability has been [addressed|https://github.com/belaban/JGroups/pull/348] in version org.jgroups:jgroups:4.0.2.Final (at the moment the latest version is org.jgroups:jgroups:4.1.1.Final).
> The org.jgroups:jgroups dependency would require an upgrade to resolve the vulnerability.
>
--
This message was sent by Atlassian Jira
(v8.20.1#820001)