[jira] [Commented] (TOMEE-2947) Upgrade quartz-openejb-shade in TomEE 8/9

["Richard Zowalla (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/TOMEE-2947?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17252660#comment-17252660 ] 

Richard Zowalla commented on TOMEE-2947:
----------------------------------------

https://github.com/apache/tomee/pull/742

> Upgrade quartz-openejb-shade in TomEE 8/9
> -----------------------------------------
>
>                 Key: TOMEE-2947
>                 URL: https://issues.apache.org/jira/browse/TOMEE-2947
>             Project: TomEE
>          Issue Type: Improvement
>          Components: TomEE Core Server
>    Affects Versions: 9.0.0-M2, 8.0.5
>            Reporter: Bruce Heavey
>            Priority: Minor
>
> TomEE 8.0.5, 9.0.0-M3 uses quartz-openejb-shade-2.2.1.jar which has a critical security vulnerability in it (CVE-2019-13990).
>  
> An existing JIRA ticket TOMEE 2672 has produced a newer version of this jar file (2.2.4) which corrects the security issue and TomEE 7.1.4 seems to ship with that new jar file. However the change was not applied to TomEE 8 or 9 which are now less up to date than TomEE 7.
>  
> It would be great to see the new quartz-openejb-shade-2.2.4 jar file incorporated into TomEE 8 and 9.



--
This message was sent by Atlassian Jira
(v8.3.4#803005)