You are viewing a plain text version of this content. The canonical link for it is here.
Posted to server-dev@james.apache.org by "Tellier Benoit (JIRA)" <se...@james.apache.org> on 2018/01/29 03:37:00 UTC
[jira] [Closed] (JAMES-2198) Fix CVE-2017-12628: Upgrade
commons-collection
[ https://issues.apache.org/jira/browse/JAMES-2198?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Tellier Benoit closed JAMES-2198.
---------------------------------
> Fix CVE-2017-12628: Upgrade commons-collection
> ----------------------------------------------
>
> Key: JAMES-2198
> URL: https://issues.apache.org/jira/browse/JAMES-2198
> Project: James Server
> Issue Type: Improvement
> Components: James Core, JMX
> Affects Versions: master
> Reporter: Tellier Benoit
> Priority: Major
> Labels: easy-fix, security
> Fix For: master
>
>
> It fixes vulnerability described in CVE-2017-12628. The JMX server, also
> used by the command line client is exposed to a java de-serialization
> issue, and thus can be used to execute arbitrary commands. As James
> exposes JMX socket by default only on local-host, this vulnerability can
> only be used for privilege escalation.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
---------------------------------------------------------------------
To unsubscribe, e-mail: server-dev-unsubscribe@james.apache.org
For additional commands, e-mail: server-dev-help@james.apache.org