You are viewing a plain text version of this content. The canonical link for it is here.

Posted to issues@activemq.apache.org by "pcwang (Jira)" <ji...@apache.org> on 2020/03/06 01:43:00 UTC

[jira] [Updated] (AMQ-7436) Fix CVE issues for log4j, jackson-databind and jolokia-core

     [ https://issues.apache.org/jira/browse/AMQ-7436?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

pcwang updated AMQ-7436:
------------------------
    Summary: Fix CVE issues for log4j, jackson-databind and jolokia-core  (was: Fix CVE issues for log4j,jackson-databind and jolokia-core)

> Fix CVE issues for log4j, jackson-databind and jolokia-core
> -----------------------------------------------------------
>
>                 Key: AMQ-7436
>                 URL: https://issues.apache.org/jira/browse/AMQ-7436
>             Project: ActiveMQ
>          Issue Type: Bug
>    Affects Versions: 5.15.11
>            Reporter: pcwang
>            Priority: Major
>
> Due to several security issues of jackson databind(CVE-2020-8840,CVE-2019-20330 ),log4j(CVE-2019-17571) and jolokia-core-1.6.0.jar（ CVE-2018-10899 ), here propose to upgrade jackson version 2.10.1, log4j 2.13.0 and jolokia-core-1.6.2.



--
This message was sent by Atlassian Jira
(v8.3.4#803005)