You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@activemq.apache.org by "Christopher L. Shannon (JIRA)" <ji...@apache.org> on 2019/07/23 10:17:00 UTC
[jira] [Commented] (AMQ-7249) Security Vulnerabilities in the
ActiveMQ dependent jars.
[ https://issues.apache.org/jira/browse/AMQ-7249?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16890865#comment-16890865 ]
Christopher L. Shannon commented on AMQ-7249:
---------------------------------------------
In regards to your comment about providing a way to replace the existing jar....You don't have to wait for a new release for updated libraries as you can always update dependencies yourself (most of the time there won't be issues especially just for bug fix updates.) You can simply just replace them in the lib directory. This is even easier if building your project using Maven. Also keep in mind just because there's a vulnerability in a 3rd party library that doesn't necessarily mean ActiveMQ uses the library in a way to expose the vulnerability.
> Security Vulnerabilities in the ActiveMQ dependent jars.
> --------------------------------------------------------
>
> Key: AMQ-7249
> URL: https://issues.apache.org/jira/browse/AMQ-7249
> Project: ActiveMQ
> Issue Type: Bug
> Components: activemq-camel
> Affects Versions: 5.15.9
> Reporter: Harish Kumar
> Priority: Critical
> Labels: Apache, camel-core
>
> Latest version of ActiveMQ(5.15.9) which has dependent jars has Security Vulnerabilities.
> *Below are the jars with Security Vulnerabilities.*
>
> *1) camel-core-2.19.5.jar :* To be updated to latest version(camel-core-2.24.1.jar or above).
> *Reference* : CVE-2019-0188
> *Path :* org.apache.activemq-5.15.9_1/lib/camel/camel-core-2.19.5.jar
>
> *2) apache-jsp-9.2.25.v20180606.jar:* To be updated to latest version (apache-jsp-9.4.19.v20190610.jar)
> *Reference:* CVE-2018-8014 , CVE-2018-8034, CVE-2019-10241, CVE-2019-10247,CVE-2017-6056
>
> *Path:* org.apache.activemq-5.15.9_1/lib/web/apache-jsp-8.0.33.jar
> : org.apache.activemq-5.15.9_1/lib/web/apache-jsp-9.2.25.v20180606.jar
>
> Need to upgrade the above jars to the the recommended version or provide an alternative way to replace the existing jar version with the updated versions.
>
--
This message was sent by Atlassian JIRA
(v7.6.14#76016)